A survey shows that medium-sized companies are prepared to take responsibility in the event of tension and defense. But don't they trust themselves too much?
86 percent of companies are generally prepared to provide capacities for national defense. But there is a big gap between willingness and skills.
In order to find out what the “defense readiness” of medium-sized companies is like, the opinion research institute Civey surveyed 1,000 managers in July and August.
A major weak point for many companies is IT resilience because criteria such as offline backups, multi-factor authentication or regular emergency drills are not met.
Berlin. In Germany, only 3.1 percent of medium-sized companies are fully prepared to make a valuable contribution in the event of tension or defense. This is shown by a survey by the management and IT consultancy MHP and the Center for Sustainable Transformation at the Berlin Quadriga University. It is available to the Handelsblatt in advance.
86 percent of companies are generally prepared to provide capacities for national defense. But there is a big gap between willingness and skills. “The self-assessment is far too optimistic, the actual management preparation does not do it justice,” says MHP partner John Eisenhauer, who leads the defense and public sector division.
This fictional but not unrealistic scenario shows what the doubt is about: In Estonia, armed fighters without national insignia have violated the border, the Bundeswehr is transferring soldiers and equipment to the Baltics. Germany becomes a transit area for Allied troops on their way to the eastern flank, who must be accommodated and supplied. Cyber attacks on energy suppliers and banks lead to power outages and ATMs temporarily stop working. Fears are increasingly spreading among the population. What if the supermarkets close soon and there is no more gasoline? There is panic buying and long queues form at gas stations.
In such a situation, it would also be crucial for the companies. If necessary, they would not only have to support the Bundeswehr and the Allies - with the release of reservists, with transport and accommodation capacities, with spare parts and food. They also have to keep their own business and thus “normal life” in Germany running as best as possible. Federal Defense Minister Boris Pistorius (SPD) put it this way at the Interior Ministers' Conference in June: "Without an efficient civilian base, military strength remains ineffective."
In order to find out what the “defense readiness” of medium-sized companies is like, the opinion research institute Civey surveyed 1,000 managers from private companies with annual sales of between 50 million and five billion euros in July and August.
In addition to the self-assessment, parameters were also asked that indicate how well the companies are actually prepared to survive even in difficult times. For example, how resilient its own IT is, whether the company has developed contingency plans in the event of a defense, or how transparent and resilient its supply chains are.
“For defense readiness, it depends on what services companies can actually provide in an emergency – in what quantity, with what lead time and over what period of time,” explains Torsten Oltmanns, managing director of the Center for Sustainable Transformation.
And here the results are rather sobering. 93 percent of companies classify their respective industry as relevant for security of supply. But only a good three percent meet all of the basic requirements for the ability to cope with crises and shocks such as a defense situation. Almost half – 48.4 percent – met none or only one requirement. Only around four out of ten medium-sized companies have already fully identified their possible role in a defense situation.
A major weak point for many companies is IT resilience because criteria such as offline backups, multi-factor authentication or regular emergency drills are not met. Three out of four companies can only overcome a complete failure of their IT systems for one to three days at most. According to the survey, there are major deficits in this area, especially in the transport and logistics sectors: “We see significant gaps in digital resilience precisely where Germany is particularly dependent on the economy in the event of defense,” says Oltmanns.
The preparation for possible crisis scenarios too often remains on the surface, says the President of the Federal Association for Security in Business (VSW), Johannes Strrumpfel. “Which company dares to completely shut down its data center and restart it from a backup if it runs the risk of production coming to a standstill?” asks the manager who is responsible for security in the Siemens Group.
Other studies also show that the German economy and society's ability to defend itself is not yet at its best. As early as 2025, the German Hospital Association presented a study according to which German hospitals only have limited ability to respond to crises and defend themselves. According to a survey by the IT association Bitkom, almost a third of companies stated that they could not maintain their business operations without the Internet or for a maximum of five hours.
Politicians have certainly reacted, for example with the so-called Kritis umbrella law or the NIS 2 implementation and cybersecurity strengthening law. The former sets minimum requirements for the safety of critical infrastructure systems, such as power plants. The latter imposes risk management obligations on companies in various sectors with more than 50 employees or an annual turnover of ten million euros.
However, the President of the VSW Federal Association does not believe in burdening companies with additional regulations, which often only lead to “paperwork”. “It must be in the company’s own best interest to deal with these issues because, in case of doubt, it is about their existence,” says Strrumpfel.
From the perspective of MHP partner Eisenhauer, Germany “doesn’t have to start from scratch”. Many companies already have technologies for a resilient supply system. What is now important is networking so that “in the event of a crisis, government agencies and companies can quickly identify what services are available, where dependencies exist and what alternatives are available,” says Eisenhauer.
