The AI Cybersecurity Playbook for the German Mittelstand.
Ten pages that put your situation in order: how attackers use AI, which AI your people are already using, what NIS2 asks of the leadership level. No hype, no product pitch, with a self-assessment and a 30-day plan.
- 10 pages
- Free
- No sales call required
Artificial intelligence has changed cybersecurity on both sides. Attackers write flawless phishing emails, imitate voices and act in minutes. At the same time employees adopt AI tools on their own, often without approval and without IT knowing. This playbook turns that into something you can act on: four fields of action, concrete measures, a plan for the next 30 days.
Download the free playbook
Fill this in once and the download is ready immediately. We only get in touch if you want us to.
Four fields of action instead of a list of 200 measures.
Security rarely fails for lack of knowledge. It fails for lack of sequence. The playbook assigns every measure to one of four fields, so it is clear what has to happen first.
See
Make devices, identities, data flows and AI usage transparent. You can only protect what you know about. This field answers the question of what is actually running in your company.
Protect
Shrink the attack surface: patching, hardening, access, training. This is where the best ratio of effort to effect sits, starting with multi-factor authentication everywhere.
Respond
Detect incidents quickly and handle them in a structured way. No protection is complete. What decides the outcome is how fast something is noticed and how orderly the first minutes are.
Prove
Document measures, for NIS2, insurers and customers. Under NIS2 it is no longer enough to be secure. Companies have to be able to prove it, and the leadership level is accountable for that.
What the ten pages cover.
When phishing becomes perfect
The old rule about clumsy wording is history. What is changing in concrete terms: personalization at scale, deepfake calls in the name of management, attacks that unfold in minutes. With four immediate measures.
Shadow AI: the AI your IT does not know about
Where data actually flows out: inputs into public AI services, browser extensions reading your mail, linked accounts with cloud access. And why a list of bans is the wrong reflex.
Identities are the new point of entry
Most attacks do not start with a hacked server but with a compromised account. The typical sequence in four steps, from a leaked password to fraud committed against your own customers.
Every device, every gap, at all times
While everyone looks at AI, unpatched systems, open remote access and forgotten devices remain attack vector number one. AI changes only one thing: attackers find those gaps faster.
Your security does not end at your firewall
The IT provider with remote access, the tax office with your financial data, the supplier with a system connection. NIS2 makes supply-chain security an explicit part of risk management.
The decisive first minutes
Response in five steps: isolate, alert, assess, recover, learn. Plus the detail many miss: under NIS2 an early warning is due within 24 hours.
NIS2: from being secure to proving it
What the directive requires at its core, and why documentation is not bureaucracy but increasingly decides whether insurers pay and major customers award contracts.
Self-assessment, checklist, 30-day plan
Eight yes-no questions with scoring, ten core measures to tick off and a plan that spreads the four fields of action across four weeks. The part you can start with on Monday.
An example from chapter 1.
For years the rule was: you spot phishing by poor language, strange senders and clumsy wording. Generative AI now writes flawless, context-aware messages in your company's tone, referencing real projects pulled from LinkedIn, your website or earlier data leaks.
Dear costumer, you're Account was blocked!! Click here immediatly to verify you're details.
Easy to spot
Hi Ms. Klein, attached is the corrected invoice for the Nordbau project. The due date has changed, new bank details are in the PDF. Best, Thomas
Correct signature · real project reference · clean tone
Illustrative example from the playbook, not real data.
Eight questions. Answered honestly.
The full self-assessment with scoring is on page 9. Here are the questions up front. If you hesitate on more than two, the playbook is worth your time.
7 to 8 times yes: a solid base, keep the level provable. 4 to 6 times: clear gaps, prioritize with a plan. 0 to 3 times: elevated risk, start this week.
- 01Do you know which AI tools your employees actually use?
- 02Is MFA active for every account, including admins and service accounts?
- 03Is there a complete, up-to-date device and system inventory?
- 04Are security updates applied continuously and provably?
- 05Is your environment monitored at night and on weekends too?
- 06Do you know which providers hold time-limited access?
- 07Is there a rehearsed incident plan with a clear escalation chain?
- 08Could you prove your measures to an auditor or insurer tomorrow?
Four weeks, four fields of action.
After 30 days you will not have perfect security. But you will have visibility, closed core gaps, a rehearsed incident procedure and solid evidence. That is the difference between hoping and steering.
See
- Run the self-assessment
- Device and AI-tool inventory
- Start the third-party register
- Identify MFA gaps
Protect
- Complete MFA rollout
- Deploy critical patches
- Deactivate old accounts
- Adopt the AI policy
Respond
- Create the incident plan
- Define the escalation chain
- Test backup recovery
- Close monitoring gaps
Prove
- Consolidate documentation
- Assess your NIS2 baseline
- Prioritize the roadmap
- Status report to management
Written for people who have to decide, not for security researchers.
Management
Under NIS2 you carry personal responsibility and cannot fully delegate it. The playbook tells you in plain language what to ask for and how to recognize whether the answer holds up.
IT leadership
You probably know most of this already. What helps here is the line of argument towards management: why 24/7 is not a luxury, why evidence relieves the board and why shadow AI is not a question of bans.
Compliance and finance
You need evidence that stands up to an auditor, an insurer or a major customer. The playbook shows which documentation NIS2 requires at its core and what a continuously maintained evidence store looks like.
Prefer to talk rather than read?
30 minutes, no obligation. We look at your situation and tell you honestly where you stand.
Book a conversationDownload the free playbook
Fill this in once and the download is ready immediately. We only get in touch if you want us to.
Frequently asked questions about the playbook
- What does the playbook cost?
- Nothing. The playbook is free and complete. There is no abridged version and no paywall on page three.
- What happens to my data?
- Your details are used solely to provide the playbook and to contact you if you want that. We do not pass them to third parties and we do not add you to a mailing list without asking. The details are in the privacy policy.
- Will I get a sales call now?
- Only if you want one. The download is not a meeting request. If you do want a conversation afterwards, the playbook and this page both show you the direct way there.
- Is the playbook legal advice on NIS2?
- No. The playbook places the requirements in context and points to the passages that matter. Whether and how NIS2 applies to your company is a case-by-case question and belongs in the hands of a lawyer.
- What size of company is this written for?
- For the Mittelstand, meaning companies without their own security operations center and without round-the-clock IT staffing. That is where the situation bites hardest, because the attack surface is wide and the defense is thin.
- Where does the content come from?
- From publicly available information published by the BSI, the wording of the NIS2 directive and the CAVRIX service description. Dashboards and figures shown are marked as illustrative and contain no real customer data.