Germany’s Mid-Market Companies Show Strong Willingness but Limited Defense Readiness

• A survey by MHP and zNT Berlin reveals a significant gap between willingness and operational readiness among German mid-market companies
• Only 3.1 percent of the companies surveyed meet all the fundamental criteria assessed
• Significant shortcomings in cyber resilience are particularly evident in logistics and transportation
• The survey included 1,000 decision-makers from German mid-market companies

Ludwigsburg/Berlin – German mid-market companies, defined in this survey as companies with annual revenues of between EUR 50 million and EUR 5 billion, are generally willing to assume responsibility in the event of a crisis or a national defense scenario. However, there is a significant gap between this willingness and their actual ability to deliver reliable capabilities at short notice. This is the key finding of a recent survey by MHP and the Center for Sustainable Transformation (zNT) at Quadriga University of Applied Sciences Berlin on the defense readiness of German mid-market companies. While 86 percent of the companies surveyed say they would generally be willing to contribute their capabilities to national defense, only 3.1 percent meet all the fundamental criteria for comprehensive defense readiness established by the survey. Approximately one-quarter meet none of the criteria assessed.

Defense Readiness Goes Beyond Available Capacity

“German businesses are prepared to assume responsibility, but willingness alone does not amount to defense readiness,” says John Eisenhauer, Partner and global Lead for Public & Defense Sector at MHP Management- und IT-Beratung GmbH. “In a real emergency, it is not enough for a company to have capabilities on paper. What matters is whether these capabilities are actually available, can be coordinated and managed, and can be sustained under crisis conditions.”

The survey does not consider defense readiness to be a single capability, but rather the result of the interplay among the following five fundamental criteria: assessing the company’s own role in a defense scenario, identifying relevant risks, ensuring transparency across critical supply chains, establishing business continuity management, and maintaining cyber resilience. These criteria form the analytical framework of the study. They indicate whether companies have established the essential prerequisites for maintaining their operations and delivering reliable services under crisis and national defense conditions.

The results illustrate why a company’s general willingness does not necessarily translate into actual operational readiness. A company may have production or transportation capabilities while, for example, having failed to define its role in a defense scenario, lacking sufficient awareness of critical dependencies, or failing to make adequate provisions for an extended IT outage.

Only the combination of these capabilities allows a company to build resilience. The gap becomes particularly apparent when companies assess their own role: only around four in ten have clearly defined the role they could play in a defense scenario. This means that a large proportion of businesses lack a key prerequisite for structured cooperation with public authorities.

Cyber Resilience: The Achilles’ Heel of Logistics and Transportation

The findings on digital resilience are particularly concerning. On average, the companies surveyed have not implemented 5.5 of the nine cyber resilience measures assessed. The gaps are especially pronounced in logistics and transportation: around 91 percent of logistics companies have not implemented at least five of the nine measures examined. In the transportation sector, the same is true for almost 88 percent of companies.

“It is precisely in the areas where Germany would be particularly reliant on businesses in a defense scenario that we are seeing significant gaps in digital resilience,” says Prof Dr Torsten Oltmanns, Managing Director of zNT Berlin. “Logistics and transportation are now highly dependent on digital systems. If scheduling, communication or central IT systems fail, available physical capacity can very quickly become unusable.”

The measures examined included business continuity management, disaster recovery, incident response, regular emergency exercises, offline backups, network segmentation, multi-factor authentication, security operations or outsourced security services, and continuous monitoring. The average figure of 5.5 does not mean that every company lacks exactly five and a half measures. Rather, it represents the average number of measures not implemented across the entire sample.

A Gap Between Self-Assessment and Operational Reality

Another finding of the survey is the discrepancy between companies’ subjective assessments of their preparedness and the operational fundamentals assessed in the study. In some cases, companies rate their own preparedness more positively than the data collected would suggest. This gap in defense readiness becomes particularly relevant when several prerequisites are lacking simultaneously.

“The greatest gap lies between many companies’ positive self-assessments and the operational foundations actually in place to respond to a real emergency,” says Oltmanns. “This is not about labeling companies as unprepared across the board. It is about highlighting where individual capabilities have yet to be integrated into a reliable overall capability.”

The survey therefore deliberately distinguishes between willingness and readiness. The figure of 86 percent refers to companies’ general willingness to contribute their capabilities to national defense. It does not imply that 86 percent of companies would be operationally ready at short notice. The figure of 3.1 percent, in turn, represents the proportion of companies that meet all the defined criteria at the same time. It is not based on an external audit and does not constitute an objective assessment of individual companies’ ability to operate in wartime.

Germany Must Better Integrate Existing Capabilities

From the perspective of MHP, the key challenge is not so much to create new capabilities as to leverage existing business expertise to strengthen Germany’s overall resilience. Companies already have highly developed systems for supply chain management, scenario planning, digital twins, business continuity, and crisis management.

“We have long had the technologies needed for a resilient supply chain. What is missing is the interoperability between them,” says Eisenhauer. “Germany does not have to start from scratch. The decisive factor is integrating existing systems and capabilities in a way that enables public authorities and companies to quickly identify which services are available, where dependencies exist and which alternatives are available in a crisis.”

This is where the concept developed by MHP for a German Digital Supply Hub comes in. The objective is not to create a new central data silo, but to establish a secure and interoperable link between existing systems and capabilities. This would make private-sector capabilities more visible, accessible, and manageable in a crisis.

From the perspective of MHP and zNT, improving defense readiness requires not only technical interoperability, but above all clearly defined roles, joint planning and exercises, greater transparency into critical capabilities and supply chains, and binding interfaces between the public and private sectors.

The complete analysis and the resulting Defense Readiness Index will be presented in detail in a subsequent publication.

Methodology and Statistical Details

Between July 31 and August 17, 2026, Civey conducted an online survey on behalf of MHP of a total of 1,000 private-sector decision-makers at the team leader level or above. Respondents represented various industries and worked for companies with annual revenues ranging from EUR 50 million to EUR 5 billion. The results are subject to a statistical margin of error of ±3.1 percentage points for the overall results. Civey collects data from verified participants using its proprietary technology.

The defense readiness rate of 3.1 percent represents the proportion of companies that meet all the fundamental criteria established by the survey simultaneously.
 
The underlying criteria cover a range of capabilities that make defense readiness operationally definable and measurable. The criteria were selected based on the study partners’ experience in resilience, crisis preparedness, supply chain management, and cybersecurity. The study partners consider them to be meaningful indicators of a company’s ability to maintain the availability and functionality of its operations and services under crisis conditions.

About the Center for Sustainable Transformation (zNT)

The Center for Sustainable Transformation (zNT – zentrum Nachhaltige Transformation) at Quadriga University of Applied Sciences Berlin supports businesses, policymakers, and society in driving sustainable and resilient transformation. Its work focuses on the economic and societal conditions required for successful transformation, particularly the interplay among the public sector, businesses, and other societal stakeholders.