Get in touch with us
We at accompio will be happy to help you.
13.11.2026
A cyberattack can encrypt systems or reveal data. For companies, another consequence is often even more serious: they can no longer produce, serve customers, or communicate reliably.
Cybersecurity therefore needs to protect not only individual IT systems, but the ability of the entire company to act and deliver. How do connected supply chains, the connection between IT and production, and artificial intelligence change risks? And what can companies do to remain operational even in the event of an emergency? We discuss this with Stefan Höpfel, Head of Cybersecurity at Netz16 (part of the accompio group).
In the expert interview, he explains Stefan Höpfel, Why cybersecurity is a responsibility of corporate management, what specific risks arise in connected production environments, and why preparation for the worst is just as important as defending against attacks.
Anyone who views cybersecurity only as the protection of individual servers, devices, or applications overlooks the connections between them. Attackers seek an accessible path to their target—and this can also involve a supplier, platform, or other third party.
For Stefan Höpfel, therefore, it is crucial not to view technical vulnerabilities in isolation. Companies must understand that, how their systems, partners, and business processes are interconnected. Only then can it be assessed which access points are particularly critical and what consequences a successful attack would have.
This perspective also changes the central question of security planning: not just „Which system could fail?“ but „What services could we no longer provide?“
This connection becomes particularly clear when classic IT and Operational Technology (OT) come together. OT includes, for example, machines and control systems in production. Their communication is important for operation, but is not fully transparent in every company.
Stefan Höpfel recommends making it visible first, Which machines communicate with which other systems. Based on this, production networks can be specifically segmented and interfaces to IT can be evaluated. In doing so, IT and OT should be considered together, without equating their different requirements.
A failure in a production environment is not automatically just an ordinary IT problem. If a machine fails or a production island becomes inaccessible, the immediate availability of the production can be affected. Security measures must therefore take into account the actual operational processes.
Artificial Intelligence It changes cybersecurity on both sides. It can help to identify anomalies and vulnerabilities more quickly. At the same time, attackers can also speed up and automate processes.
For companies, this means that detected security vulnerabilities must not remain unaddressed. They must be evaluated and promptly closed according to their significance for business operations. This further increases the importance of reliable vulnerability and patch management.
Another topic is the Shadow AIEmployees may use AI applications without the company having clearly established which information is allowed to be entered there. This raises questions about how to handle confidential data. Companies should therefore create transparency about the applications used and establish clear rules for their use.
Encrypted systems and stolen data are serious consequences of an attack. However, the business risk goes further: a company may temporarily be unable to manufacture, deliver, bill, or communicate with important contacts.
How critical an incident becomes therefore also depends on, How long the standstill will last And which processes are affected. Stefan Höpfel advises companies to first identify the points in their security planning that would hit them particularly hard if they failed.
This analysis provides the priorities for investments. Patch management and Backups They are among the fundamentals; which further measures should be implemented first depends on the respective business model and its critical dependencies. Cybersecurity is not a one-time investment: risks and technologies change, so protection measures must be reviewed regularly.
Not every attack can be prevented. The more important it is to prepare for the eventuality that protective measures are not sufficient.
„For me, resilience means being able to survive an attack and remain capable of action.“
Stefan Höpfel, Head of Cybersecurity at Netz16 (part of the accompio group)
Cyber resilience This therefore encompasses more than just restoring systems. Companies should determine how they can make decisions, reach out to employees, and continue essential operations during an outage. Stefan Höpfel gives an intentionally simple example for this: an up-to-date, printed phone list. If digital communication channels are unavailable, even such preparation can be crucial.
The practical test is as follows: Do the responsible persons know what they need to do and whom they need to contact if the usual systems are not available?
Security responsibility cannot be fully delegated to a specialized department. Management must decide which risks are acceptable, which services must remain available at all costs, and where investments are made.
Stefan Höpfel compares this to occupational safety: There too, management does not equate necessary protective measures with the indication that a specialist is responsible. In cybersecurity, the same basic attitude is needed.
This includes a culture where employees can report errors or suspicious activities early on, rather than hiding them out of fear. Equally important is a realistic view of the security status. Management should not only ask for positive metrics but also want to know:, where risks are not yet sufficiently controlled.
Regulatory requirements such as NIS-2 They can help ensure that these issues are addressed more at the management level. However, they do not replace the company-specific assessment of its own risks.
accompio helps companies identify cyber risks, develop appropriate protective measures, and strengthen their resilience against security incidents.
Cybersecurity begins with technical protection but does not end there. It is crucial whether a company can also provide its most important services under difficult conditions or resume operations promptly after an incident.
For this, companies need to know their critical business processes and dependencies, understand IT and OT risks, continuously maintain basic protection measures, and prepare for the worst-case scenario. Certifications can make security requirements visible. However, the true measure of whether a company is resilient is in its ability to, how well it can actually secure its ability to act and deliver.
Stefan is the Head of Cybersecurity at Netz16 and represents the topic within the accompio group. He brings 25 years of industry experience and focuses in particular on how companies can avoid cyber incidents and remain operational even in the event of an emergency.
Because attackers can exploit connections and access between systems – even through platforms, suppliers, or service providers. Companies therefore need to understand their attack paths and their potential impact on business processes.
OT security concerns, among other things, machine and control systems in production environments. It is important to know their communication and interfaces with IT, assess risks, and make meaningful network segmentation where it is required by operations.
AI can accelerate the search for vulnerabilities and the automation of processes – on both the attacker and the defender side. Companies therefore need clear rules for their own AI use and must promptly assess recognized security vulnerabilities.
Cyber resilience is the ability to survive a security incident, maintain critical processes as much as possible and restore operations. This includes prepared decisions and functioning communication channels in addition to technical measures.
The starting point is the business consequences of a failure: Which processes must function flawlessly and where would a prolonged downtime be particularly critical? Based on this, companies can examine fundamental aspects such as patch management and backups and plan further measures specifically.
Because security incidents can affect production, delivery capacity and, consequently, business viability. The management must address risks and priorities, clarify responsibilities and foster a culture in which problems become visible early on.
