Plans, security concepts and vulnerability analyses serve a clear purpose: they help operators identify threats and better protect their facilities. This is precisely why such information is particularly sensitive. Which areas of a facility are particularly critical? Where are the access points? Which components require special protection? Where have vulnerabilities been identified? What security systems are in place? What measures are triggered in an emergency?
If such information falls into the wrong hands, it could, under certain circumstances, help to build up an accurate picture of a facility and its security measures. An attacker might then not need to identify vulnerabilities on site first. Information from the digital realm could be used to prepare a physical attack.
This also changes our understanding of what needs to be protected. The physical perimeter consists of more than just a fence, gate, access road and site grounds. The information describing this perimeter is also an asset worth protecting.
Cyber and Physical Security: Two Sides of the Same Security Strategy
Digitalisation has fundamentally transformed the protection of buildings, industrial facilities and critical infrastructure. Camera systems are networked, access controls are managed digitally, sensors continuously provide data, and control centres consolidate information from various security systems. This interconnectedness opens up significant opportunities. Information can be analysed more quickly, incidents detected earlier and security processes partially automated. At the same time, new interdependencies are emerging between digital and physical security.
This is because the connection works both ways. A cyber attack can expose information that is relevant to the physical security of a facility. Conversely, a physical attack on technical components, communication channels or poorly protected access points can have an impact on digital systems. And an attack on networked security technology can, in turn, impair the ability to detect or verify physical threats. Viewing cyber and physical security in isolation is therefore increasingly inadequate. The more physical security systems are digitised and networked, the more cyber security itself becomes an integral part of perimeter protection.
NIS-2 and the KRITIS Framework Act: What belongs together is also converging in regulatory terms
This development is now also evident in the regulatory framework. The NIS-2 Implementation Act, which has been in force since 6 December 2025, has significantly expanded the cybersecurity requirements for numerous companies and organisations. These include, amongst other things, requirements for risk management as well as registration and reporting obligations. With the KRITIS Framework Act, a further layer was added in 2026: the physical protection of critical infrastructure. The aim is to identify risks at an early stage, take appropriate resilience measures and strengthen the capacity to respond to disruptions and crises. The Federal Office for Information Security (BSI) describes this development as an extension of the regulatory framework to include the physical protection of critical infrastructure. Whilst digital and physical resilience are addressed in different sets of regulations, in operational practice they both relate to the same facilities, processes and responsibilities.
Operators are therefore faced not only with the question of whether their own IT systems are adequately protected, or whether fences, CCTV and access control are commensurate with the respective risk. What is crucial is the interplay between these factors: What digital information is relevant to physical security? Who has access to it? How is it stored and exchanged? What would be the consequences if it were compromised? And which physical security systems, in turn, are dependent on digital systems and data?
Digitalisation creates opportunities – and new data that requires protection
This issue is becoming increasingly important as digitalisation progresses. One example of this is the digital twin. Buildings, sites, fences and access routes – as well as any damage – can be digitally recorded and combined to form a detailed representation of a facility. AI-based systems can recognise objects, analyse critical distances and help to identify hazards or vulnerabilities. In the future, security assessments can be compared with requirements and protection concepts, and measures derived from this. This opens up new possibilities for security planning. The more comprehensive the digital situational picture, the more precisely risks can be identified and protective measures planned. However, this also gives rise to a second challenge: the more detailed the digital representation of a facility becomes, the more sensitive the information it contains may be. A dataset that is valuable to security officers may, under certain circumstances, also be valuable to an attacker.
The cyberattack on Berlin’s state network highlights just how quickly the boundaries between digital and physical security can become blurred. An assessment is still underway to determine exactly which data has been compromised and what the consequences will be. Yet, regardless of the specific case, this scenario highlights a fundamental challenge for the protection of critical infrastructure.
Security managers today no longer need simply to know where physical vulnerabilities lie. They must also know where information about these vulnerabilities is stored, who has access to it, and what happens if this information is compromised. This requires integrated security concepts that address cyber and physical risks together: from the current situation, through threat and risk analyses, to technical and organisational protective measures, responsibilities and contingency plans. The Federal Office for Civil Protection and Disaster Assistance regards precisely this systematic identification and mitigation of risks as an integral part of comprehensive risk and crisis management for critical infrastructure. Perimeter protection is also evolving at this interface.
At Perimeter Protection, taking place from 19 to 21 January 2027 in Nuremberg, physical security, digitalisation and innovative security technologies come together. From smart camera systems and access control, through AI-based applications, to digital twins, the focus is increasingly on a common question: how can new technological possibilities be utilised without creating new security vulnerabilities? Because in a connected security landscape, the following applies more than ever: anyone who wants to protect the physical perimeter must also protect their digital information.
