Industry · Logistics & Transport

One shipment passes five stations. At four of them, someone else's system has a say.

Air, rail and water transport including ports are listed in Annex 1 BSIG, postal and courier services in Annex 2. Larger hubs such as ports fall under the KRITIS sector Transport and Traffic once they cross certain thresholds. We test your security where it is actually decided: along a single shipment, from order intake through warehouse, gate and transhipment hub to final delivery. Transport management, warehouse management, terminal control and the people at the gate all sit on those stations, and at most of them somebody works alongside you who is not on your payroll.

Get your logistics IT tested See the route

The route

One shipment, five stations, five attack surfaces

The route follows a single shipment through your chain, from order intake to final delivery. Each station shows what happens there, who besides you has a say, and what we test. Almost everywhere an outside system is wired into the station, and that is what makes the chain brittle: a standstill rarely stays where it started.

Customer portal, EDI, customs Your systems only Outside drivers & guards Terminal & hub partners Delivery partners 01 Order 02 Warehouse 03 Gate 04 Hub 05 Delivery Order accepted Shipment delivered
  • Outside system at this station
  • Your own systems only
Cutting across all five stations: customer and supplier interfaces. APIs and portals for shipment tracking, EDI connections and freight booking wire your network straight into your partners'. When one station goes down, the outage rarely stays with you. The next partner in the chain notices first, and the customer notices next.

The shipment travels the route on its own. A click on a station stops it so you can read in peace.

Order intake TMS, customer portal, EDI connection

What happens here

The order rarely originates with you. It arrives through a customer portal, an EDI connection or as an email in dispatch, and lands in the transport management system that plans routes, freight and orders centrally. From there the same data travels on to customs, subcontractors and clients.

Who besides you has a say

Clients with their own portal access, EDI partners, customs agents and subcontractors processing the very same record.

What we test here

Authentication and tenant separation in the portals, permissions on the interfaces, how dispatch handles unfamiliar freight enquiries. The core question is whether a partner account can reach beyond its own tenant.

See web app & API pentest

Threat picture

The numbers

Two independent sources, one picture: transport and logistics are in the crosshairs, and the weak spot is rarely just technical.

  • 7.5% of all incidents hit the transport sector, making it the second most-targeted sectorENISA Threat Landscape 2025
  • 20.8% of those hit logistics specifically, with 58.4% hitting aviationENISA Threat Landscape 2025
  • 78.8% of logistics companies surveyed had already been directly or indirectly affected by a cyberattackSophos/techconsult, Sept. 2025, 147 respondents
  • 4,875 incidents analyzed between July 1, 2024 and June 30, 2025 as the basis of the ENISA reportENISA Threat Landscape 2025

The bars show each figure's share of its own population, not the state of any single company. What is open at your place only shows up in a test along your own route.

Station 03 · The human factor

The biggest attack vector in logistics isn't your firewall

Gates, terminals and loading docks see dozens of unfamiliar drivers, subcontractors and delivery partners every single day, on top of high turnover among gate security staff. Someone posing as a subcontractor's driver or a delivery partner exploits exactly that routine: they act confidently, reference a supposed delivery slot, and gate staff, used to this kind of traffic, wave them through. Once inside, warehouses, terminal areas and often unsecured network ports are within reach.

The point is not that gate staff are careless. The point is that on a normal day their job is precisely this: move strangers through quickly so the ramp stays clear. Testing that means testing it under real conditions, and then talking to the people afterwards instead of putting them on the spot.

„The biggest challenge remains the human factor.“

Michael Veit, security expert at Sophos

Three pretexts that work in daily operations

We do not restage movie scenes. These three approaches come out of the operation itself and can be run at almost any site.

  1. Access at the gate

    Confident manner, a supposed delivery slot, a fitting name picked up from publicly visible sources. After that, the warehouse, the loading bays and often unsecured network ports are within reach.

  2. Manipulation inside TMS or WMS

    Anyone who gets in through weak tenant separation or an unprotected partner interface can reroute tours, alter inventory or siphon off shipment data without ever seeing a gate.

  3. Phishing in dispatch

    Time pressure, driver communication and a constant stream of new contacts make the ideal setting for a forged freight enquiry with an attachment or a login link. In dispatch, mail is sorted by urgency, not by sender domain.

Three cases

What has already happened in the industry

Three incidents at logistics companies, as described in media reports. Not isolated cases, but a pattern.

  1. Hellmann Worldwide Logistics

    Osnabrück · ransomware

    The Osnabrück-based logistics provider was hit by a ransomware attack.

  2. Swiss Post Cargo Germany

    approx. 1,600 business customers

    A cyberattack on the company affected roughly 1,600 business customers. That number shows what hangs off a chain: in the end it hits everyone whose shipments run through that company.

  3. DSV

    October 2025

    In October 2025 a group calling itself CoinbaseCartel listed the freight giant as a victim on its leak site. DSV neither confirmed nor denied an attack and said its systems and operations were not affected.

Based on public reporting. Access Granted was not involved in these incidents.

See our own pentesting track record

Scope of obligation

What is regulated at which station

Air, rail and water transport including ports are listed in Annex 1 BSIG, postal and courier services in Annex 2. The recast German BSI Act has applied since December 6, 2025, and whether your company counts as an important or particularly important entity is decided by the test sequence in § 28 BSIG, based on sector, headcount and revenue. Larger hubs such as ports can additionally qualify as critical infrastructure once they cross certain thresholds. Instead of another list of paragraphs, the table shows what the obligations mean along the same route.

Station What it comes down to in practice Reference
01Order intake Supply chain security and the handling of partner access are explicitly part of the required risk management measures. Art. 21 NIS2, § 30 BSIG
02Warehouse & picking Network separation, access control and hardening of your own systems in line with the state of the art. § 30 BSIG
03Gate & loading Access control, physical security and personnel topics count as risk management. Technology alone does not satisfy the requirement. § 30 BSIG
04Transhipment hub Once a hub crosses the thresholds for critical infrastructure, a recurring proof of compliance to the BSI is added, every three years since the reform instead of every two. § 39 BSIG, KRITIS regulation
05Delivery & tracking Significant security incidents must be reported in stages: an early warning within 24 hours, an incident notification within 72 hours, and a final report after one month at the latest. Anyone who does not know their own attack surface will miss those deadlines. § 32 BSIG, Art. 23 NIS2

We deliver the penetration test and the technical evidence you can put into your documentation. Classification, registration with the BSI and the legal assessment stay with you and your legal advisers.

NIS2 pentest in detail KRITIS pentest in detail Check your scope for free

Our approach

The test runs the same route

Ongoing freight flow and delivery deadlines come first. That is why our approach is closely coordinated with dispatch and terminal operations, and every stage is settled in writing beforehand.

  1. Stage 01

    Scoping with operations in mind

    Together we define which stations are tested actively and which are only analyzed passively, especially around terminal control and shipments in transit. Third-party sites and partner systems stay out of scope unless their operator has agreed in writing.

  2. Stage 02

    Reconnaissance & attack preparation

    Gathering information from public sources, network scans, and preparing realistic attack scenarios, including pretexting approaches targeting the gate and dispatch. Whatever is publicly findable about you is where every real attacker starts.

  3. Stage 03

    Test execution

    Manual testing within the agreed scope, with a defined emergency contact and an immediate stop if there is any unexpected impact on the flow of goods. Critical findings are reported straight away, not saved for the report.

  4. Stage 04

    Analysis & risk assessment

    Every finding is rated by severity, exploitability, and impact on delivery capability and terminal operations. A finding that stops a loading bay therefore ranks above one that is only theoretically disruptive.

  5. Stage 05

    Final report & presentation

    Full documentation with remediation guidance, a management summary, and mapping to NIS2 or KRITIS requirements. On request we present the results to management and IT separately, because the two bring different questions to them.

The order is fixed, the scope is not. We test the stations you release and leave out whatever would put the running flow of goods at risk.

Relevant modules

These tests bring your logistics IT up to standard

From dispatch to the gate, a single test won't get you there. Each module covers a different station of the route, and in practice they complement each other.

  • Station 03

    Physical Pentest

    Simulated access attempts at gates, warehouses, and terminal areas. Covers the physical attack surface that shows up especially often in logistics.

    Learn more
  • Stations 03 & 05

    Social Engineering

    Phishing and pretexting simulations tailored to dispatch, driver communication, and the constant flow of outside visitors at the gate.

    Learn more
  • Station 02

    Infrastructure

    Network segmentation between office IT, TMS/WMS and terminal control, access rights, the hall network and interface hardening.

    Learn more
  • Station 04

    OT & terminal control

    Control systems at the hub: network connectivity, remote maintenance and separation from office IT, examined without any active interference in running operations.

    Learn more
  • Stations 01 & 05

    Web apps & APIs

    Customer portals, shipment tracking, freight booking and EDI interfaces, focusing on authentication and separation between tenants.

    Learn more

Pentesting in logistics & transport: your questions

Not automatically. In transport, Annex 1 BSIG lists air, rail and water transport including ports plus traffic management, Annex 2 lists postal and courier services; a pure road haulier or warehouse operator is not a listed entity type. Whether your company is specifically in scope depends on its size and classification as an important or particularly important entity; the test sequence for that is set out in § 28 BSIG. Larger hubs such as ports can additionally fall under the KRITIS regulation.

A Sophos/techconsult survey from September 2025, covering 147 logistics professionals and executives, found that 81% name human error or lack of security awareness as a central risk. That tracks with how the industry works: high staff turnover, constant outside traffic at the gate, and time pressure in dispatch all wear down vigilance against phishing and pretexting.

Yes, that's part of our Physical Pentest module. We simulate realistic access attempts, for example posing as a driver or subcontractor, and check whether the gate, access controls, and warehouse areas hold up. Beforehand we agree who on site is in the know and how gate staff are brought in afterwards, without anyone being put on the spot.

Yes. Smaller and mid-sized forwarders often assume they're too small to be targeted, but they're frequently connected to larger supply chains through EDI interfaces and subcontractor relationships, making them an attractive detour for attackers. ENISA's finding that transport is the second most-targeted sector doesn't break down by company size.

That depends heavily on scope: how many locations, whether TMS/WMS systems and terminal control are included, whether physical and social engineering testing are part of it. After a free initial consultation, we know your scope and you get a transparent fixed-price quote.

Depending on scope, testing typically takes one to three weeks, followed by analysis and reporting. Critical findings that need immediate action are flagged to you right away, not held back for the final report.

NIS2 applies to important and particularly important entities in transport. KRITIS (Transport and Traffic) additionally applies only to operators that cross certain thresholds, such as large ports or hubs, and comes with its own, stricter obligations under BSIG. Both can apply in parallel.

Yes. We test transport management and warehouse management systems as well as APIs and portals for shipment tracking or freight booking, usually focusing on authentication, authorization between tenants, and securing interfaces to subcontractors and customers.

We don't, unless the operator has given written clearance. A transhipment terminal or a delivery partner's data centre is someone else's property, and testing it without permission would be a criminal offence. What we do instead: we test from your side what a compromised partner account could do to you, and how far a partner reaches into your systems.

Usually yes. Large shippers pass their own requirements down to the forwarder by contract, because supply chain security is part of their own obligations under Art. 21 NIS2. A pentest report with scope, methodology, findings and remediation status is the customary evidence for that. Whether it is enough in a given case is your client's call, not ours.

Sometimes all it takes is a fake delivery slip at the gate.

Let's use a short call to work out where you stand on NIS2 and KRITIS and which stations of your chain come first. You'll get a fixed-price quote afterward, no strings attached.

Book your compliance consultation Write to us directly
Take this page with you as a printable flyer (PDF)

Contact

Address
Albert-Einstein-Straße 1, 95028 Hof
E-Mail
hello@access-granted.de
Phone
+49 9281 5918506

AccessGranted X GmbH · HRB 7266 · Hof (Saale)

Company

Services

Regulatory pentests

Industries

Networks & trust seals
Trust Seal of the IT Security Association Germany (TeleTrusT)
Participant in the Alliance for Cyber Security
© AccessGranted X GmbH Last updated: September 18, 2026