A call after the worst-case scenario
A company calls. Ransomware. Production has come to a standstill. The first question: “How could this happen?” A better question would have been: “Why didn’t we do anything about it before?”
Many companies still treat information security as a chore – something you do because you have to. It is regrettable that regulatory pressure is often needed to make this happen, but given human weaknesses in dealing with statistics and risk, it is hardly surprising.
Most people are simply not very good at understanding abstract probabilities or realistically assessing long-term risks. This applies not only to individuals, but also at the organizational level: Information security risks often seem vague, technical, far removed from core business activities, and rarely appear urgent in the hectic day-to-day routine.
But this is precisely where information security comes in: as a systematic attempt to make risks visible and manageable. And not just when an auditor demands it, but continuously, proactively, and in the service of the organization’s own business objectives.
Information security is more than just technology
Nevertheless, information security continues to be viewed as a purely IT problem in many organizations. When people talk about “security,” they quickly say, “We need a new firewall” or “We finally have to roll out EDR.” While well-intentioned, these responses fall short. After all, information security is not a toolbox—it is a strategic task.
The correct order is not: buy a tool, tick the box, feel secure. Instead, it is: understand the risks, derive requirements, identify appropriate measures – and only then think about tools. Those who understand security solely in technical terms miss the opportunity to design it in an economical, process-oriented, and company-wide manner.
Vibe security instead of risk management
Unfortunately, many companies still operate according to the principle of “vibe security”:
Vibe security (noun, ironic): Security measures that are introduced because they “seem right,” are popular, or are adopted by others – not because they fit the company’s risks or needs. The opposite of this is risk-based information security.
The loudest risks get attention (“the squeaky wheel gets the grease”), while structural weaknesses remain hidden. Security then becomes a reactive, action-oriented process instead of a planned course of action. This not only leads to inefficiency, but also to a false sense of security.
ISMS: A necessity, not a luxury
A functioning information security management (ISMS) is therefore not a luxury, but an operational necessity. And it is relevant in every industry – not just where IT plays a central role.
Even a medium-sized napkin manufacturer can fall victim to a ransomware attack – and in the worst case, file for bankruptcy because production comes to a standstill. This company would most likely not have fallen under the requirements of NIS2. Nevertheless, the case clearly shows that structured security management – as required by NIS2 – would have been enormously beneficial in such cases. After all, ransomware is not interested in thresholds or industry classifications – only in vulnerable systems.
An ISMS serves to raise awareness of risks, evaluate them, and make informed decisions based on this evaluation. Those who know the risks can accept, avoid, mitigate, or transfer them. Those who do not know them act blindly – and that can be expensive. And this applies not only to cyber threats, but also to human error, organizational deficiencies, or inadequate access controls. Security is never just about technology – it is always about culture, structure, and processes.
What does it cost to do nothing?
Information security is not just a protective mechanism – it is also a cost control tool. In a functioning ISMS, measures are geared to the actual protection needs of the company and its assets. This means that investments are targeted where they are necessary and make sense. At the same time, oversized or unnecessary measures are avoided – which often leads to lower overall costs.
A frequently heard argument is: “We can’t afford it.” But the opposite is true: information security saves money – not in the form of immediate returns, but through avoidable damage.
An ISMS helps prioritize security measures based on the actual risk profile rather than gut feeling. Controls are not introduced because they are “modern,” but because they help reduce the Annualized Loss Expectancy (ALE) – i.e., the expected annual cost of a risk. So the crucial question is not: “What does it cost?” – but rather: “What does it cost us if we do nothing?”
Regulation as a catalyst
Regulation such as NIS2 is therefore not just a constraint, but an opportunity. It forces companies to address risks before damage occurs. This is inconvenient, but healthy in the long term.
In a sense, companies must be forced to act in their own best interests. Without external impetus, many risks remain invisible – and therefore unaddressed. However, the aim of regulation is by no means to enforce perfect security. Rather, it is about establishing structured risk awareness and documented decision-making capabilities – exactly what a good ISMS should do anyway.
Security does not have to be perfect
Information security does not mean eliminating every risk. It means being aware of risks and putting them in the right context. It is perfectly legitimate to accept risks – provided this is done consciously and within a commercially acceptable framework.
Information security does not have to be perfect, but sufficient. But this requires a system. A framework. A strategy. It is not about maximum security, but about appropriate security in relation to the business model, risk appetite, and protection requirements.
A functioning ISMS does not thrive in silos, but in a corporate culture that promotes responsibility and openness. Security is not a foreign body in the company—it is part of its identity.
Governance instead of paper tigers
Information security is therefore not the responsibility of IT. It is a question of governance – and thus a matter for top management. Without clear responsibilities, defined goals, and a common understanding of risk, security remains a paper tiger. Or worse: a patchwork of measures that feels secure but does not provide real security.
Good security governance defines who is responsible for what, how risks are escalated, and on what criteria decisions are made. It anchors information security in corporate management – where it belongs.
Conscious decisions instead of checkbox compliance
A mature ISMS only selects measures that make sense in relation to the asset being protected. Either because the costs are acceptable and the protection is necessary – or because a conscious decision has been made against it. In any case, however, the decision is made consciously.
This is precisely what distinguishes security governance from mere compliance. Checkbox compliance may save effort in the short term, but in the long term it increases uncertainty because it does not address risks, but only documents them.
Conclusion: Information security is a management responsibility
Information security is not a sacrifice, but a form of control. It is not a cost, but an investment. And ultimately, it is not an IT issue, but a corporate responsibility.
Those who understand this act not out of fear, but out of insight – and thus lay the foundation for resilience, trust, and sustainable success.
