German firms lag behind on AI cyber defenses
Germany’s federal cybersecurity agency, the BSI and the TÜV Association have released findings indicating that only one in ten German companies are adequately prepared to counter AI-driven cyber threats, even as such attacks escalate. Their survey of more than 500 firms revealed that one in six had suffered an AI-related breach within the past 12 months. Phishing attacks dominated, accounting for 90% of reported incidents, while automated vulnerability scans appeared in 40% of cases. Deepfake schemes, often linked to fraud targeting executives, were used in 11% of breaches.
Despite these risks, only 31% of companies leverage AI for cybersecurity, and just 11% have dedicated protocols to address AI-specific incidents. The disparity is stark: while 45% of AI-using firms perform risk assessments before deployment and 52% test applications for security weaknesses, 8% maintain no technical safeguards whatsoever. Access controls are enforced by 64% of respondents, and 62% implement data protection measures, yet gaps remain.
Nearly half of German businesses already integrate AI into operations, with an additional 9% planning adoption in the next year. Among current users, 45% assess risks before deployment, and 52% verify applications for vulnerabilities. Most restrict AI tool access (64%) and shield sensitive data (62%), though 8% operate without any security measures. The reluctance to adopt AI stems largely from data protection and security concerns, with 42% of firms ruling out AI use entirely.
Thomas Caspers, vice president of the BSI, warned that even non-AI users remain vulnerable. He noted that AI-supported attacks pose risks to all businesses, regardless of their own AI strategy. The study confirms that automated threats, such as phishing, scripted probes, and deepfake fraud, expose organizations indiscriminately. Dr. Dirk Stenkamp, president of the TÜV Association, emphasized the need for third-party validation. He stated that trust in manufacturers’ self-declarations has been shaken, adding that the association’s new certification framework for AI systems may launch by the end of the year.
The survey also found that 69% of companies that use AI or plan to use AI expect independent testing and certification to increase the safety and reliability of AI applications. Dr. Stenkamp noted that employees often struggle to identify AI-generated threats, suggesting that current breach figures may only represent the tip of the iceberg. Companies now face the challenge of ensuring robust security testing as they advance AI capabilities.
