Cybersecurity Boom: Why NIS2 Is Turning Germany’s Security Industry into a Growth Engine
4 min Read Time
Germany’s IT security market surpassed the €10-billion mark for the first time in 2024 – and is growing twice as fast as the overall IT market. The catalyst? NIS2: Starting December 6, 2025, 29,500 companies across Germany must meet stricter cybersecurity requirements – six times more than under the previous regime. Compliance costs totaling €2.2 billion flow directly to German security providers.
The Key Takeaways
- €10.1 billion market volume: Germany’s IT security market reached €10.1 billion in 2024 – for the first time ever. Bitkom forecasts 10.1% growth in 2025, lifting the market to €11.1 billion (Bitkom, 2025).
- NIS2 multiplies regulated entities sixfold: NIS2 entered into force in Germany on December 6, 2025 – immediately, with no grace period. The number of regulated companies rose from 4,500 to 29,500 – a more-than-sixfold increase (Federal Ministry of the Interior, BMI, 2025).
- Skills shortage acts as a brake: Estimated one-time compliance costs: €2.2 billion. Average implementation cost per company: €86,900 (NIS2 Implementation Act, Explanatory Memorandum).
- 72,000 security incidents: In 2024, the BSI (Federal Office for Information Security) registered over 72,000 incident reports – an increase of 21%. It published 24,531 vulnerabilities, 15% of them classified as critical (BSI Threat Landscape Report, 2024).
- Personal liability for managing directors: Managing directors face personal liability for violations – fines up to €10 million or 2% of global annual turnover (NIS2 Implementation Act § 65).
NIS2: The Regulatory Big Bang
On December 6, 2025, Germany’s NIS2 Implementation Act entered into force – immediately, with no grace period. Overnight, 29,500 companies were legally required to elevate their IT security to a level many had never previously contemplated.
The scale is hard to overstate. Under the old NIS1 regime, only around 4,500 entities were regulated – primarily traditional critical infrastructure operators such as energy suppliers, water utilities, and hospitals. NIS2 massively expands that scope: 8,100 “essential” entities and 20,900 “important” entities – including mechanical engineering firms, food producers, chemical companies, and digital service providers. As with the digital transformation of public administration, regulation is proving to be a powerful modernization driver.
The estimated €2.2 billion in one-time costs for implementing new security processes amounts to nearly a quarter of the entire market volume for 2024. This isn’t incremental change – it’s an investment surge that is structurally reshaping the market.
Who Benefits: German Providers Gain the Edge
secunet Security Networks, an Essen-based provider with deep ties to the public sector, posted 15% revenue growth in 2024. The company supplies SINA encryption technology to the German Armed Forces and federal agencies – and benefits directly from NIS2-driven demand in the public sector.
Munich-based Rohde & Schwarz Cybersecurity specializes in network encryption and web application security. Demand for VS-NfD-certified solutions – products approved for handling classified information – has outstripped capacity. For German authorities and KRITIS (critical infrastructure) operators, this matters: Only a handful of vendors worldwide hold this certification.
The trend toward digital sovereignty further strengthens German providers’ advantage. Companies required to store sensitive data within the European legal jurisdiction increasingly prefer European security solutions. The U.S. CLOUD Act and ongoing repercussions from the Schrems II ruling act as catalysts – a dynamic also leveraged by Germany’s hidden champions as a competitive edge.
“Cybersecurity is no longer an optional IT project – it’s a legal obligation carrying personal liability for managing directors.”
– Core statement of the NIS2 Implementation Act
72,000 Incidents: The Threat Is Real
BSI figures leave no room for doubt. In 2024 alone, the agency recorded 72,000 security incident reports – a 21% increase year-on-year. It published 24,531 vulnerabilities, 15% of them rated critical. Ransomware remains the top threat, followed by supply-chain attacks and advanced persistent threats (APTs) launched by state-sponsored actors.
For SMEs, this means: Cybersecurity is no longer optional – it’s a statutory duty with personal liability for managing directors. NIS2 holds executive leadership directly accountable for implementing appropriate security measures. Ignoring it risks fines of up to €10 million – or 2% of global annual turnover – a risk that belongs squarely on the CEO agenda for business continuity.
What This Means for Companies
Three consequences are now urgent. First: If your company isn’t yet NIS2-compliant, there’s no more time. The deadline has passed – the implementation process must be underway. Second: The market for qualified security service providers is tight – secure trusted partners early. Third: Investing in cybersecurity isn’t just about compliance – it’s a strategic competitive advantage. Companies that demonstrably control their security posture become preferred partners in regulated supply chains.
Frequently Asked Questions
Further Reading
- Digital State: Germany’s Public Administration in the 21st Century – MyBusinessFuture
- Cybersecurity Trends 2026: The 7 Developments Every Security Leader Must Know – SecurityToday
- Digital Resilience: Why Business Continuity Belongs on the CEO Agenda – Digital Chiefs
Header Image Source: Pexels / Christina Morillo