Insights · Market guide

The DACH cybersecurity market and threat landscape in 2026

Attacks on companies in Germany, Austria and Switzerland remain at a high level, and ransomware, weak internet-facing systems and supply chain access are the recurring causes. At the same time, NIS2 and related rules now push thousands of additional organisations to buy security services. This guide summarises the latest official figures and what they mean for buyers and providers.

Updated: 6 November 2026

The threat picture in numbers

The latest BSI report is the 2025 edition, published on 11 November 2025; the 2026 edition is due this month. The BSI describes the situation as tense. It reports an average of 119 new vulnerabilities per day, about 24 percent more than in the previous period, and 950 ransomware attacks recorded by the Federal Criminal Police Office, largely unchanged. About 80 percent of the reported ransomware attacks hit small and medium-sized companies. Financially motivated cybercrime fell by 9 percent, which the BSI partly links to international law enforcement work.

The Bitkom study Wirtschaftsschutz 2026, based on 1,003 German companies, found that 96 percent were affected or suspect they were affected by theft, espionage or sabotage in the past twelve months. Bitkom estimates the total annual damage at 211 to 270.8 billion euros, of which cyberattacks make up 76 percent. 63 percent of the companies saw more cyberattacks than a year earlier.

In Austria, the Federal Criminal Police Office counted 63,459 cybercrime reports in 2025, up 1.8 percent. Cybercrime in the narrower sense, where IT systems are the target, rose 8.6 percent to 21,988 reports, and 111 ransomware cases were reported. In Switzerland, the BACS received 27,128 voluntary reports and 200 mandatory reports in the first half of 2026, plus 79 ransomware cases, a stable number.

Main threats

Ransomware stays the central business risk. In the Bitkom study, 45 percent of companies had been hit by ransomware in the past twelve months, and 20 percent of those affected paid a ransom. The BSI notes that backups do not help against the second step of extortion, the threat to publish stolen data. The BACS observes a more fragmented ransomware landscape, and in Austria the groups INC and Akira were the most active named ones.

• Weak perimeter systems: the BSI sees poorly configured servers, vulnerable web applications and late patching as common entry points.
• Supply chain and vendor access: the BSI warns about providers and manufacturers who keep lasting, poorly controlled access to customer systems, especially in cloud, energy and automotive.
• Phishing and fraud: the BACS reports rising Microsoft 365 phishing, takeover of business email accounts and impersonation of IT helpdesks or managers, increasingly with AI-written messages.
• DDoS and sabotage: DDoS made up 15 percent of damaging attacks in the Bitkom study and 12.7 percent of mandatory incident reports in Switzerland. The BACS says sabotage is a risk in geopolitical tension but has seen no targeted attacks on Swiss critical infrastructure so far.
• State actors: 37 percent of the Bitkom respondents named foreign intelligence services among the attackers, up from 28 percent a year earlier.

Regulation that drives demand

Germany: the NIS-2 implementation act came into force on 6 December 2025. The BSI expects about 29,500 regulated entities, compared with about 4,500 before. As of 30 September 2026, 20,141 entities were registered in the BSI portal, and the BSI had received 1,272 initial incident reports under NIS2. Covered companies must register, document risk management measures and report significant incidents.

Austria: the NISG 2026 replaces the NISG 2018 and applies from 1 October 2026. The WKO speaks of roughly 4,000 companies and institutions in 18 sectors. Significant incidents require an early warning within 24 hours, a notification within 72 hours and a final report within one month. The registration deadline is described inconsistently by secondary sources, so check it with the authority.

Switzerland: the country is not bound by NIS2. Instead, operators of critical infrastructure have had to report cyberattacks to the BACS within 24 hours since 1 April 2025, and fines of up to 100,000 francs for missing reports apply since 1 October 2025. Swiss companies can still be pulled in by EU customers who pass NIS2 requirements down their supply chain.

DORA, the EU regulation on digital operational resilience in the financial sector, has applied since 17 January 2025 and covers financial firms in Germany and Austria.

Market size and the skills gap

Bitkom, citing IDC data, puts the German IT security market at 14.3 billion euros in 2026, up 11.7 percent, and forecasts 15.8 billion euros for 2027. Software accounts for 7.8 billion euros and grows fastest at 14.5 percent. Services reach 5.3 billion euros with growth of 7.3 percent. Bitkom also reports that about 79,000 IT specialists are missing in Germany in 2026; the study gives no absolute figure for security specialists alone, which is one reason many companies buy capacity instead of hiring it.

Which services are in demand

No official report ranks services by demand, so the following is our reading of the requirements and findings above. NIS2 asks for incident handling, vulnerability handling and supply chain security, and the BSI found attack detection to be the weakest area among critical infrastructure operators, at 48 percent. That points to these services.

• Managed SOC and MDR/EDR: continuous monitoring and response without building a 24/7 team.
• Incident response and retainers: a contract with defined response times before an attack happens, which also supports the 24-hour reporting duties.
• Vulnerability assessment and penetration testing: regular scanning and proof of fixed weaknesses on internet-facing systems.
• Cloud and identity security: hardening Microsoft 365 and other cloud services, multi-factor authentication and access control.
• Supplier risk reviews and NIS2 gap analyses for companies that sell into regulated customers.

What this means for buyers

Start with scope: check whether you are a regulated entity yourself or a supplier of one. Then define the project in terms of outcomes, such as detection coverage, response times in hours and reporting support, instead of tool names.

• Ask where data is processed and which sub-providers have access, since 70 percent of Bitkom respondents want European security solutions preferred.
• Agree contract terms that match the reporting clocks of 24 and 72 hours.
• Request clear handover points between your team and the provider, and a named contact for incidents.
• Compare offers for the same defined scope rather than by price per month alone.

What this means for providers

Demand is shaped by deadlines: German entities now have to register, document measures and report incidents, and Austrian companies face their first obligations from October 2026. Providers who can explain which NIS2 requirement a service covers, in the language of the country, are easier to compare. Mid-sized companies are the main growth segment, since the BSI points out that most ransomware victims are small and medium-sized firms with limited resources. Packaged, fixed-scope offers with clear reporting support fit these buyers better than open-ended consulting.