heise-offer: NIS2 and KRITIS: How SMEs are building cyber resilience

The IT Security Day Dortmund, held on September 16, 2026, at the Hochschule Dortmund, focused on the challenges and opportunities of digital sovereignty and IT security in an AI-driven world. The conference, organized by heise and the Hochschule Dortmund, aimed to shift perspectives on cyber resilience, particularly for mid-sized companies. Unlike large corporations that often deal with digital sovereignty through cloud providers and open-source strategies, mid-sized businesses face more tangible questions about operational continuity during cyber incidents, such as whether operations can continue if systems fail, data becomes encrypted, or service providers become unreachable. This event emphasized how cyber resilience is less about procurement decisions than about architecture, processes, and preparedness. The conference’s keynote theme, “Digital Sovereignty and IT Security, Challenges and Opportunities in an AI-Driven World,” included discussions on AI resilience, LongSec, LLM security, and early threat detection. However, a key focus was placed on the mid-sized sector, which is often overlooked in broader sovereignty debates. Robert Stricker from Materna presented a session titled “Fortress Midsize: Implementing Cyber Resilience Effectively.” He outlined how companies can comprehensively protect themselves against digital threats while enhancing their resilience. His talk integrated technological safeguards with design principles such as Security-by-Design, employee awareness programs, and compliance with regulations like NIS2 and the KRITIS umbrella law. The central question posed was how cybersecurity can become a strategic success factor and ensure business stability even during crises. For security officers and IT project managers in mid-sized organizations, the situation is complex. Cyberattacks, system failures, and regulatory pressure frequently coincide with limited staffing resources. As a result, resilience has evolved into a core business responsibility that extends beyond the IT department. The conference addressed this challenge by offering practical insights into common security gaps when using large language models and the risks associated with prompt injection from a LangSec perspective. It also explored potential attack vectors arising from autonomous systems accessing repositories, tickets, and internal tools. A research project called C2PANDA examined how network data in virtualized and high-performance environments can be analyzed for forensic purposes and intrusion detection. Throughout the day, participants had the opportunity to engage directly with speakers during the “Ask the Expert” sessions following each presentation block. These interactive segments allowed attendees to ask detailed questions and gain deeper understanding. The program also featured networking breaks and an exhibition area where vendors showcased relevant technologies and solutions. The one-day conference took place from 9:30 AM to 5:30 PM at Emil-Figge-Street 40, Hochschule Dortmund. It was designed for security professionals, security experts, hackers, IT project managers, and IT students. The standard ticket price was 279 euros including VAT, with lunch included. Tickets were available through the online shop.