Critical infrastructure cybersecurity: detect attacks, protect operations

Obligations for critical infrastructure operators

In Germany, critical infrastructure operators (known as KRITIS) must take appropriate state-of-the-art precautions, regularly prove them to the BSI (the Federal Office for Information Security) and report significant disruptions. Since May 2023, the use of attack detection systems (Systeme zur Angriffserkennung, SzA) has also been mandatory. Under the German NIS2 Implementation Act, these obligations continue to apply to operators of critical facilities in the new BSI Act (BSIG); the NIS2 requirements come on top.

Attack detection systems (SzA)

An attack detection system must continuously capture and evaluate security-relevant events and trigger countermeasures in the event of an attack. XMfortress Detect combines signals from firewall, endpoint, identity and cloud into prioritized incidents; XMfortress Respond responds within a defined policy – from a recommendation to automatic isolation.

Look at IT and OT together

In many facilities, office IT and control systems (OT) are more closely connected than planned. Attacks often start in IT and move laterally toward the plant. Attack path analysis reveals these paths; XMfortress Gate separates the zones and allows OT protocols selectively.

Sovereignty and verifiability

For critical infrastructure, traceable supply chains and control over data are what count. XMfortress Gate is developed in Europe; data stays in the EU. Reports and historical data from the platform serve as evidence for supervisory authorities and auditors.