Incident Protection & Response Service

The threat of cybercrime remains high in Germany. According to police crime statistics (Polizeiliche Kriminalstatistik, PKS), 131,391 cases of cybercrime were registered in 2024. In addition, there were a further 201,877 cases in which the perpetrators operated from abroad or from an unknown location (BKA, 2024). These and many other surveys make it clear that companies are exposed to a constant digital threat, regardless of industry and size.

Companies that fail to prepare comprehensively risk not only financial damage, but also significant reputational damage and regulatory sanctions. While companies often recognize the urgency of taking action and even have contingency plans in place in case of doubt, there is usually a lack of practical experience. There is a lack of clear roles, coordinated procedures and a validated recovery strategy. These deficits become apparent in an emergency at the latest, when delays, information gaps and wrong decisions occur despite the emergency plan, which increase the damage.

In collaboration with the responsible parties and experts from our network, we were able to make the disaster manageable while taking into account the requirements of the stakeholders – whether owners, suppliers, customers or authorities. Our success is not only reflected in the rapid restoration of business activities and the satisfaction of our customers, but is also confirmed by independent auditors.

Preparing for a cyber incident is often seen as an IT issue, but in terms of business continuity management, it is an issue for the entire company. In the event of an attack, relying solely on technology means that important business processes are down for longer than necessary and that priorities, alternative solutions and emergency measures have to be laboriously worked out during the crisis. This costs time and money – in two respects.

The increase in successful attacks – mostly ransomware attacks¹ – that partially or completely paralyze companies has changed the focus on IT. It has suddenly become clear that nothing works without IT. Accordingly, the time after a cyber incident is discovered is particularly critical. This is when it is crucial to quickly contain the attack and restore business processes to pre-crisis levels with as little downtime as possible. This includes immediate measures, stakeholder-oriented communication, compliance with legal requirements and the restoration of business processes prioritized according to their importance for the company. In order to organize this restart effectively, many years of experience are required not only in the operation of IT infrastructures, but above all in the entrepreneurial evaluation of the procedure in such crises.

Our goal: maximum security with minimum impact on your business operations

On request, our experienced crisis team will take over the operational management of the crisis team and will be at your side around the clock. Our aim is to ensure maximum security while minimizing the impact on your ongoing business activities.

In a crisis, speed, clarity and experience count. As external crisis experts, we provide immediate relief, establish structures and bring decision-making certainty to uncertain situations. Your added value at a glance:

• Immediate takeover of crisis management including organisation, internal and external communication as well as setting up and structuring all necessary management and decision-making processes
• Fast Response with strategic realignment after the crisis to not only become fit for work again, but to emerge stronger from the situation
• Interim management and short-term filling of critical roles to compensate for absences and close operational gaps
• Establishment of structured crisis management and introduction of a continuous improvement process for your emergency and restart processes
• Strengthening your ability to react through targeted measures for damage limitation, better decision-making and clear allocation of roles in the event of a crisis

Not every incident leads to a crisis – but every cyber crisis starts with an incident. The right preparation is crucial for the outcome.

Many companies have a crisis plan, but no established practice. In the event of an emergency, there is often a lack of clearly defined roles, coordinated decision-making channels and reliable interaction between IT, management and specialist departments. The result: delays, uncertainty, reputational damage and economic losses.

The time immediately after a cyber incident is crucial. Those who are prepared can quickly contain the attack and get the most important business processes back up and running as quickly as possible. This requires a holistic view that combines IT, management and communication – and a well-coordinated team that can act confidently in an emergency.

¹In Germany alone, 950 ransomware attacks were reported in 2024 (number of unreported cases probably higher) (BKA, 2024).