A new reality calls for a new understanding of security
For a long time, the focus was on traditional security issues: how can buildings, networks or individual pieces of infrastructure be protected against attacks? Whilst these questions remain relevant, they are increasingly falling short in the light of current developments. This is because today’s threat landscape is characterised by hybrid risks. Sabotage, espionage, cyber-attacks, drone activities, extremism and disinformation do not occur in isolation, but can reinforce one another. Security has therefore long since ceased to mean merely preventing attacks. What is required is the ability to function reliably even under difficult conditions.
This requires a shift in perspective: away from the exclusive protection of individual assets, towards safeguarding critical functions. The focus is not on the building or the system, but on the question of which services must be reliably delivered even in the event of a crisis.
Networking is becoming a crucial factor for success
No single actor can tackle the current challenges alone. The state, the private sector, operators of critical infrastructure and security authorities are more dependent on one another than ever before. Yet there is often no shortage of information. Companies have access to sensor data and security alerts; authorities gather situational information; and operators of critical infrastructure monitor anomalies in their networks and facilities. The real challenge lies in bringing these insights together to develop a shared understanding of the situation.
This is precisely where data rooms and shared situational awareness platforms come into play. They enable the secure and sovereign exchange of information without relinquishing control over one’s own data. Only when all stakeholders act on the basis of comparable information can complex crises be effectively managed.
Interoperability rather than siloed solutions
However, networking only works if the technical and organisational prerequisites are in place. Common standards, interoperable systems and robust communication channels play a key role. Different organisations must be able to exchange information, coordinate processes and make joint decisions. This applies to security authorities as well as to companies and operators of critical infrastructure.
Simply introducing more and more individual tools does not in itself create resilience. What is crucial is an architecture that links technical and organisational structures and makes complexity manageable. Common standards, resilient infrastructures and secure communication channels form the basis for this.
Known risks must be consistently addressed
Most of the challenges have long been known. Risk analyses, audits and regulatory requirements have been highlighting where action is needed for years. With NIS2, the KRITIS umbrella law, the Cyber Resilience Act and DORA, the regulatory framework is expanding further.
Nevertheless, in many places there remains a gap between knowledge and action. Often, the necessary information is already available. The greater difficulty lies in deriving concrete measures from this information, setting priorities and consistently implementing changes. It is precisely here that the true resilience of organisations is determined. Clear responsibilities, binding targets, regular reviews and measurable progress thus become essential building blocks of modern resilience.
People remain the most important factor
However important technology may be, in a crisis it is people who make the decisions. Employees are often the first to notice unusual occurrences. They spot anomalies, report incidents and must prepare or make decisions under time pressure. To enable them to fulfil this role, they need clear processes, effective reporting channels and regular drills.
Organisational culture is coming increasingly into focus. Resilient organisations emerge where people take responsibility, share information and develop routines for exceptional situations. It is precisely in crises that the value of trust, personal networks and well-established collaboration becomes apparent.
The true test comes after the incident
Resilience is often still equated with protective measures. However, whether a system is actually resilient usually only becomes apparent once a disruption has already occurred: how quickly can systems be restored? Are spare parts available? Are there alternative processes or fallback locations? Does communication still work even when mobile networks or the internet are down? And do supply chains remain stable?
The ability to repair and recover, in particular, is frequently underestimated. Alongside robustness and redundancy, repair capability, knowledge management and resilient supply chains are therefore becoming increasingly important. The real test is not whether an incident occurs. What matters is how quickly organisations can subsequently resume operations and continue to deliver their services.
What would make Germany more resilient
Four key areas for action can be identified from the current challenges:
- Strengthen cooperation. The state, the private sector and operators of critical infrastructure must be able to exchange information more quickly and with greater trust.
- Expand interoperability. Common standards and compatible systems lay the foundation for effective coordination across organisational boundaries.
- Broadening resilience. Resilience must not be a concern solely for operators of critical infrastructure. Small and medium-sized enterprises, local authorities and public institutions must also strengthen their preparedness.
- Regularly practise crisis response. Contingency plans alone are not enough. Only through exercises can routines be established, enabling organisations to act confidently even in exceptional situations.
Resilience is a team effort
Germany will not become more resilient through a single technology, yet another law or additional security measures. What matters is how effectively the state, the business sector and society exchange information, take responsibility and act in a coordinated manner in crisis situations. Preparation, networking and robust structures are just as important as technical solutions.
Particularly in an era of hybrid threats, it is clear that security does not arise from protection alone. It arises from the ability to manage disruptions, maintain services and adapt quickly to changing conditions.
The key insight is therefore this: no organisation can become resilient on its own. Resilience arises where government bodies, businesses and societal actors jointly take responsibility. The better this collaboration works, the more robust Germany will be in the face of the crises and challenges of the future.
