Cybersecurity in the skilled trades: one in three companies sees deficits
A recent Sophos survey of 200 trade businesses shows: While 64 percent feel well prepared for cyber incidents, 36 percent still see a need to catch up. The clothing, textile and leather trades are particularly affected, with almost 29% of businesses rating their preparation as poor.
Today, digital systems, networked applications and mobile working methods characterize the processes in workshops, on construction sites and in the administration of craft businesses. As part of a survey of craft and craft-related businesses, Sophos investigated the question of how cyber security is organized and how businesses assess their own preparation.
Cybersecurity is anchored in the organization
Cybersecurity is clearly assigned in most of the surveyed skilled trades and skilled trades-related companies. 67% of companies operate cyber security in-house and with additional support from external service providers. A further 19.5 percent rely exclusively on internal resources, while 12.5 percent have outsourced the issue entirely to external providers. Only 1 percent of companies state that there is no clear responsibility.
The organizational structures are largely comparable across the trades and company sizes surveyed. One exception is the clothing, textile and leather trade, where 42.9% of companies completely outsource cyber security to external service providers.
Safeguarding digitally supported processes
Digital networking is an integral part of daily work in many trade businesses - for example through machine control systems, digitally connected tools or mobile devices on construction sites. 58% of the companies surveyed state that they have established clear security guidelines, regular updates and access controls for networked systems. 29 percent secure individual devices or applications, but not consistently. 10.5 percent rely on the security concepts of manufacturers or providers to secure networked systems.
Different assessment of own preparation
When it comes to assessing their own preparation for a cyberattack, a differentiated picture emerges. 20% of the companies surveyed rate their preparation as very good and expect to be able to resume operations immediately. A further 44% stated that they were well prepared and would be able to resume operations after a short time.
In contrast, 30.5% state that they would only be able to work to a limited extent in the event of a cyberattack. A further 5.5 percent feel poorly prepared and expect longer downtimes. Individual companies confirm that they are not prepared at all or are unable to assess their situation with certainty.
Once again, the clothing, textile and leather trades stand out: 28.6 percent of the companies surveyed said they were poorly prepared in the event of a cyberattack.
Conclusion: Clear structures, but varying degrees of readiness
«Cybersecurity is now firmly anchored in operational processes in the skilled trades - often in clearly defined organizational structures. Transparency about processes, responsibilities and their own level of preparation plays a key role here. However, the assessment of cyber resilience in the skilled trades sector is significantly below the level of larger companies,» says Michael Veit, security expert at Sophos.
«For the attackers, however, it makes little difference who is being attacked. Even smaller companies have valuable data and information that cyber criminals can misuse for their own purposes. It is therefore important that effective cyber security, if necessary with external expertise, takes place at a very high level.»
Four recommendations for craft businesses
Define clear responsibilities: Responsibilities and processes should also be clearly defined when working with external service providers. Systematically consider digital systems: IT systems, applications and networked processes should be regularly reviewed and included in security measures. Regularly review resilience and preparation: A regular review of your own ability to restart after cyber incidents supports the assessment of the actual situation. Continuously develop cyber security: Technical and organizational protective measures should be reviewed and adapted on an ongoing basis.
The evaluation is based on a quantitative survey of 200 companies conducted by Techconsult on behalf of Sophos in December 2025 and January 2026. Companies from the following sectors were surveyed: Construction and finishing trades, electrical and metal trades, wood and plastics processing, food trades, clothing, textile and leather trades, health, personal care and cleaning trades, arts and crafts as well as industries related to crafts, technical services and other craft-related businesses. The survey included companies with more than 20, 50, 100 and 250 employees.
