While the need for better security is widely acknowledged, many industry representatives are questioning the feasibility of the BSI's demands, particularly regarding the financial impact on smaller businesses. Critics argue that mandating high levels of investment could stifle innovation and force many small and medium-sized enterprises to divert funds away from growth and research. They warn that a one-size-fits-all approach to security regulations may be impractical for companies with limited IT budgets and staff.
Skeptics of the BSI's proposal emphasize that the government should focus on providing better support and resources rather than simply demanding more spending. They suggest that instead of imposing new costs, the state should offer tax incentives, subsidies, or shared security platforms that allow smaller firms to access high-level protection without bearing the full financial weight. Without such support, there is a fear that the new requirements will lead to market consolidation, where only the largest corporations can afford to remain compliant.
There is also concern regarding the effectiveness of throwing money at the problem. Some experts argue that technology alone is not a silver bullet and that the focus should be on improving digital literacy and human-centric security practices. They point out that many breaches occur due to human error, such as phishing, which cannot be solved by hardware upgrades alone. Critics suggest that the BSI should prioritize education and standardized best practices over expensive infrastructure projects that may quickly become obsolete.
Finally, there is a call for greater transparency regarding how these funds will be managed and where they will be directed. Skeptics want to ensure that the money is not lost in bureaucratic processes but is instead used to create tangible, measurable improvements in security. They argue that without clear accountability and a focus on practical, scalable solutions, the push for more investment could result in wasted resources that fail to address the actual, day-to-day risks faced by the average business or citizen.