From cybersecurity to national security
24th June 2025 • Hilton Munich City, Munich
What must change now that cybersecurity is less about business risk and more about national resilience?
Time to take cybersecurity (much) more seriously?
Russia's hybrid warfare tactics against the West could eventually lead to NATO invoking the alliance's mutual defence clause, Germany's intelligence chief has warned. Bruno Kahl, the head of the German Federal Intelligence Service (BND), said recently that he expected Russia to increase its hybrid attacks, which can range from physical acts of sabotage such as arson to cyberattacks and disinformation campaigns.
Federal Minister Nancy Faeser has also noted the importance of cybersecurity for societal stability, stating, “Cybersecurity is central to our society and affects each and every one of us.” She highlighted that extortion, cyber espionage, and hybrid threats— especially from state-sponsored actors—continue to pose significant risks, necessitating robust cybersecurity investments to safeguard democratic institutions.
Implicit in these statements is an important fact: governments have come to accept that the cybersecurity of the private sector is integral to national security. Why the private sector? First, because most CNI is in the hands of, or relies on, the private sector. Second, because third-party vulnerability means that even wholly state-owned and run organisations will depend on private third parties and in any case the entire commercial ecosystem relies upon countless third-party dependencies both known and unknown.
So, what does this heightened governmental focus on cybersecurity mean for security professionals?
Most obviously it means more investment and an increase in taking concrete actions to boost security. Yes, senior management is now on message but hiring and budgets statistics are not consistent with taking cybersecurity as seriously as is needed.
This requires senior business leaders to understand that everyone is now equally at risk as everyone is a potential weak link in the ecosystem of societal security ready to be exploited by a nation-state aggressor. This also means that narrow risk to the P&L is not the only measure of risk. Mapping security spends to the (relatively low) average loss statistics might seem like sensible risk management, but it creates systemic weakness that makes those loss stats a significant underestimate. Investment must rise.
Transparency is also critical. The secrecy around security incidents is both absurd and damaging. Hackers know your defences – they are not a secret. Incident reporting does not paint a target on your back because everyone is already a target. And hiding information means everyone, including law enforcement, is underestimating losses and risks.
Transparency also means more meaningful collaboration – necessary because adversaries are good at sharing the latest ‘best practice’ and so we must be too.
And it means getting the basics right: in Germany recent attacks have included DDoS attacks and ransomware attacks on a wide range of state and private-sector targets. So:
