Cyber risks in SMEs: Which actions come first?

A new threat report, a customer questionnaire and another audit: the task list keeps growing. For a small IT team, the useful question is which action reduces a relevant risk now, and how will we know it worked?

TL;DR: Choose a useful next step

• Start with a business process whose disruption would matter.
• Check access, recovery and reporting arrangements for that process.
• Select actions based on actual gaps. Assign owners, dates and evidence.
• Test the outcome. Closing a task alone does not prove effectiveness.

As of 13 October 2026. The occasion is the CYBERsicher Lagebild 2026, published on 5 October. The prioritisation approach and worksheet are our editorial recommendations. The cover is an AI-generated scene featuring Julian Köhn, not a photograph of a customer visit.

What the new report means for your team

The CYBERsicher Lagebild 2026 examines threats and preparedness among German SMEs. It includes an AI-related focus and honeypot observations. Its different datasets cannot be combined into an individual attack probability for your company.

Our practical interpretation: connect a threat to your operations. “Ransomware” becomes an actionable concern when you identify the affected process, access paths and controls already in place.

Understand the process before choosing controls

Consider a fictional manufacturer. Without order data, production and dispatch planning become unreliable. An external provider maintains the application. Backups exist, but the latest recovery test is no longer current.

IT and the process owner should establish how long the application can be unavailable, which data must be recovered and who can reach the provider. Processes and business impact analysis help establish the business consequences. Evaluate the specific scenario through risk management.

Three areas to investigate

These are starting points for your assessment, not a universal ranking from the report.

1. Critical access: Who can reach essential systems?

Review administrative accounts and external maintenance access for the chosen process. Are they still needed? Does each have an owner? Have appropriate additional protections been configured and tested? Record how access can be withdrawn during an incident.

Useful evidence includes an updated access list and tests of the intended controls. The appropriate technology depends on your system and risk.

2. Recovery: Can the business actually resume?

A successful backup does not prove a successful restart. Agree a limited recovery test with IT and the business team. Check required data, dependencies and procedures in a suitable test environment, protecting production operations.

Record results, elapsed time and gaps. Compare them with your business requirements rather than an arbitrary universal target.

3. Reporting: Does an observation reach the right person?

Who reports a suspicious event? Who decides what happens next? How can a deputy be reached if email or the usual platform is unavailable? Work through a fictional case together. Our 20-minute awareness exercise provides a starting point.

Turn findings into accountable work

Record	Example for the fictional manufacturer
Affected process	Order planning and dispatch
Specific gap	Recovery of the order application has not been tested recently
Owner	Named IT owner, with business validation by the process owner
Next step	Agree test scope and date with the provider
Evidence	Test record, checked data and documented deviations
Review trigger	Relevant changes and the agreed review date

Make progress visible across teams

Separate spreadsheets can obscure whether IT, business teams and providers have actually closed a gap. Kopexa connects risks with tasks and responsibilities, helping you track implementation and evidence. The technical test still happens in the relevant systems; its purpose and result become easier to follow.

For mid-sized businesses, start with one important process and extend the approach. To explore how it fits your existing ISMS, request a demo through our ISMS software page. Bring one open action: it gives the discussion a concrete outcome.