The most expensive security problem is often not the cyberattack itself. It is the moment when operations come to a standstill. Niklas Horstmann, COO Deutsche Telekom Security GmbH, explains why security needs to move closer to the network.
Saturday, 11:42 AM. The store is full. Customers are waiting in line. The card terminal is down. Calls are not getting through. For the organic grocery store, this is not an "IT disruption." It means lost revenue. It means stress. It means a loss of trust in real time.
This is where the security question begins for small and medium-sized businesses. Not in the data center. Not in an abstract cyber-risk report. But at the register, in telephony, and in inventory management. When these systems fail, business operations come to a standstill.
That is why IT security is not primarily about tools, but about keeping your business operational. What matters is whether your most important business processes are protected and whether that protection can adapt to changing requirements. Especially for small businesses, this can mean protection that is as simple as possible and integrated directly into the network. More complex requirements call for managed network and security services or continuous detection and defense against attacks.
Attacks on small and medium-sized businesses are increasing. Not because these businesses are especially visible, but because they are often especially vulnerable. They are part of digital supply chains. They work with customer data, payment systems, inventory management, cloud services, and mobile devices. For attackers, a weak access point, a careless click, or a poorly protected service provider is often enough.
According to the Bitkom Study on Business Protection 2025, 87 percent of businesses have been affected by data theft, espionage, or sabotage in the past 12 months, or suspect such an incident.
As requirements grow, internal resources often remain limited. Many businesses do not have their own security department. Some do not even have their own IT team. Yet they are expected to detect phishing, secure locations, monitor systems, defend against attacks, prevent outages, and meet regulatory requirements.
This widens the gap between what companies need to protect and what they can manage on their own. Smaller businesses in particular therefore need security solutions that are easy to operate and provide support where internal resources are lacking. Not every company needs the same level of protection. But every company needs the right one.
Growing regulatory requirements add to this. NIS2, the European Network and Information Security Directive 2, makes cybersecurity more of a leadership responsibility for affected companies. This requires clear responsibilities, reporting channels, security measures, and documentation. Companies that are part of important supply chains, support critical services, or work with larger customers must be able to demonstrate how resilient their own IT is.
More requirements should not automatically lead to greater complexity. In many companies, additional standalone solutions have been added over the years to address new tasks. Each additional console creates new rules, alerts, and interfaces – and with them, more complexity. This takes time, makes it harder to maintain an overview, and can place an additional burden on small IT teams.
That is why more tools do not automatically create more security. A better approach is to consider network, security, and operations more holistically – with fewer gaps, greater transparency, and clear responsibilities.
For a long time, the endpoint was considered the first line of defense: laptops, servers, smartphones, and point-of-sale systems. That remains important. But on its own, it often is no longer enough today. Modern attacks often no longer come in the form of clearly identifiable malware. Attackers use valid credentials, permitted connections, and standard tools. At first, this appears inconspicuous on the endpoint.
At the same time, AI is increasingly being used for cybercriminal activities. Attacks can be automated, varied, and deployed against many targets in parallel. Above all, AI increases the number and variety of attacks. That is why defenses need to start earlier and include the network from the outset.
Within the network, suspicious connections, unusual destinations, and deviations from normal access patterns can be detected upstream, and connections can be blocked. Before the data traffic reaches the customer's systems.
The enterprise network no longer just transports data from A to B. It provides additional context to assess connections and identify suspicious behavior. Security therefore requires an extended defense that brings together device protection, the network, identity, and context.
For businesses, this means: The earlier suspicious connections are stopped, the lower the risk that an attack will lead to an operational outage.
The key is for security to match your specific complexity, risk, and operating model.
The basic idea: Connectivity and security are more closely integrated and provided as a service. What this looks like in practice depends on your specific needs. Examples include Security OnNet, Secure Business Connect, and CyberProtect.
Security OnNet provides protection directly from the Deutsche Telekom network – across both mobile and fixed-line networks. No app or installation required. Security OnNet is already active on more than 800,000 mobile contracts and more than 100,000 fixed-line connections. Across both access types, more than around 48 million threats are blocked every month – including phishing attacks, access to malicious websites, and infected botnets. For small businesses, security becomes not an IT project, but part of the connection.
Secure Business Connect combines connectivity, secure site networking, and IT security in a managed operating model. When a florist says, "The card terminal and phone service must always be up and running," it is not about Bandwidth alone. It is about operational continuity. Redundant connections and mobile backup increase the availability of business-critical applications. Telekom handles setup, operations, and troubleshooting. This makes network security not an additional burden for your business, but part of a reliable operating model.
CyberProtect is designed for companies that need to actively detect and respond to attacks. Monitoring runs around the clock, supported by AI and security specialists. It is backed by a global network of 15 Security Operations Centers (SOCs) and 1,700 security experts. There, threats are continuously monitored and analyzed, and countermeasures are initiated when needed. The services can be tailored in modules to your specific security environment and needs—without requiring you to build your own SOC. For companies subject to KRITIS or NIS2 requirements, CyberProtect also supports the logging, archiving, and analysis of security-relevant events.
The key: security comes not from more tools, but from better architecture
Over the years, many companies have introduced more and more individual solutions. Each solution had a reason. But together, they often create a complex system: many dashboards, many alerts, and many areas of responsibility.
That is risky. When you lose sight of the big picture, you cannot manage risks effectively.
A better approach is a security strategy that aligns with your actual requirements and can evolve with them. What matters is how well the network, security, and operations work together. The network becomes an important layer of defense because suspicious connections can be identified and stopped there early.
In the end, what matters is not how many security solutions a company operates. It is whether the business keeps running.
Niklas Horstmann, COO Deutsche Telekom Security GmbH, advocates intelligent, network-based threat defense. He combines technological innovation with a clear point of view on strengthening businesses in global competition. His conviction: Security needs to become simpler — moving away from complex standalone solutions toward protection delivered directly from the network. His credo: Security belongs in the network.
© 2026 Deutsche Telekom AG