Berlin – November 09, 2026 -- Cyber risk has risen in every industry group examined by Mittelstand-Digital, even though cybersecurity levels improved in eight of ten groups, according to the study cited by information security consultant Joachim Reinke of einfachISO. He identifies five recurring misjudgments that leave German mid-sized companies exposed.
Automated scans make small companies targets by default
Many SMEs assume criminals ignore them. Attackers often deploy automated programs that search the internet for known vulnerabilities, test stolen credentials and send phishing emails in bulk. Criminals typically assess a victim's value only after breaching it.
Unsupported systems and forgotten remote access create entry points
A server that has run for years without incident can still be insecure, particularly when the vendor no longer issues security updates. Forgotten remote-maintenance access and unowned applications add to the exposure. Reinke advises prioritizing: a critical flaw in an internet-facing firewall or VPN demands faster action than an issue on a single workstation.
Unclear responsibilities leave incident decisions unassigned
Delegating security entirely to the IT department or an external provider is a mistake, because management and business units must define which processes are critical and which outages are tolerable. Companies should settle in advance who may shut down systems, who informs customers and who decides on halting operations. An IT contract does not automatically cover every security task.
Untested backups and emergency plans fail under ransomware
A restored file does not guarantee that a full business application will start, since programs often depend on other systems and interfaces. Criminals increasingly target backup systems too. Reinke recommends regular full-restore tests and practical drills, with plans updated after organizational changes.
Stale access rights give attackers valid credentials
Provider accounts often stay active for years, employees keep permissions after changing roles, and former staff may retain live accounts. If an external provider is itself breached, attackers can reach its customers. Companies should review who can access which systems, limit permissions to what is necessary and deactivate unused accounts.
Reinke says he has guided more than 100 companies to ISO 27001 certification.