Your supply chain is only as secure as the gate at night

Transport management, warehouse management, terminal control and the human factor at the gate: these four stations decide how far someone gets who wants to see the flow of goods from the inside.

  • Transport sector under NIS2 per Annex 1 BSIG
  • Experience with TMS, WMS and terminal control
  • Free initial consultation

One shipment, four stations, four checks

Waybill schematic illustration, not a form used in practice
Ordered by Customer, customs, subcontractor
Handed over at Gate, loading bay, terminal
Runs through TMS, WMS, terminal control
Check stamp per station Every station signs off the shipment. What gets checked is the goods, rarely the person bringing them.
  1. 01TMS

    Transport management

    Routes, freight and orders in one place, with interfaces to customers, customs and subcontractors.

  2. 02WMS

    Warehouse management

    Goods receipt, picking, inventory. Grown over years, tightly linked to handheld scanners and mobile devices.

  3. 03Terminal

    Container and crane control

    Cranes, slot booking and container logistics run on dedicated systems that conventional IT security concepts rarely give much thought to.

  4. 04Gate

    The human factor

    Dozens of unfamiliar drivers and delivery services every day, plus gate staff who are used to exactly this traffic.

    Most underestimated
What we test at these stations

Tenant separation and permissions in TMS and WMS, the segmentation between office IT and terminal control, the partner interfaces, and whether access at the gate holds up against a supposed driver.

Cutting across all four stations are the partner interfaces: APIs and portals for shipment tracking, EDI connections and freight booking wire your network straight into your partners'.

7.5% of all incidents hit the transport sector, the second most-targeted sector ENISA Threat Landscape 2025
78.8% of the logistics companies surveyed had already been directly or indirectly affected Sophos/techconsult, September 2025, 147 respondents
81% name the human factor as a central risk same survey

Relevant modules

  • Physical Pentest

    Simulated access to gates, warehouses and terminal areas. Beforehand we settle who on site is in the know and how gate staff are brought in afterwards.

  • Social Engineering

    Phishing and pretexting, tailored to dispatch, driver communication and the visitor traffic at the gate.

  • Infrastructure Pentest

    Network segmentation between office IT, TMS/WMS and terminal control, plus access rights and the hardening of the partner interfaces.

NIS2 and KRITIS Transport

Air, rail and water transport including ports are listed in Annex 1 BSIG, postal and courier services in Annex 2. Whether you are in scope depends on your size and your classification as an important or particularly important entity. Larger hubs such as ports can additionally fall under the KRITIS regulation once they cross certain thresholds, which brings its own proof obligations under BSIG. Both sets of obligations can apply in parallel.

What we deliver and what we don't

From us you get the penetration test and the technical evidence: a report with a severity for each finding, remediation guidance, a management summary and mapping to the NIS2 and KRITIS requirements. The legal classification of your company, registration with the BSI and any form of certification are not part of it.

What has already happened in the industry

Three incidents at logistics companies, as described in public reporting.

Hellmann Worldwide Logistics

Osnabrück · ransomware

The logistics service provider based in Osnabrück became the target of a ransomware attack.

Swiss Post Cargo Germany

approx. 1,600 business customers

A cyberattack on the company affected roughly 1,600 business customers.

DSV

October 2025

In October 2025 the group “CoinbaseCartel” listed the freight giant as a victim on its leak site. DSV did not confirm an attack.

Based on public reporting. Access Granted was not involved in these incidents.

How a test runs at your company

  1. 1

    Scoping

    Together we define which systems are tested actively and which are only analysed passively, and which pretexts come into question for the gate and dispatch.

  2. 2

    Test execution

    Reconnaissance using public sources, network scans, and after that manual testing according to the agreed scope, with an emergency contact and an immediate stop.

  3. 3

    Assessment and report

    Every finding rated by severity, exploitability and impact on delivery capability and terminal operations, plus a management summary and mapping to NIS2 and KRITIS requirements.

Depending on scope, test execution typically takes one to three weeks, followed by analysis and reporting.

Frequently asked questions

Is NIS2 mandatory for freight forwarders?

Not automatically: in transport, Annex 1 BSIG lists air, rail and water transport including ports, Annex 2 lists postal and courier services. A pure road haulier is not a listed entity type. Whether you are specifically in scope depends on size and classification. Larger hubs can additionally fall under the KRITIS regulation.

Are smaller freight forwarders realistic targets too?

Yes. Small and mid-sized forwarders are often connected to larger supply chains through EDI interfaces and subcontractor relationships, which makes them a detour to a bigger target. ENISA's finding on the transport sector does not distinguish by company size.

Do you also test physical access to warehouses and terminals?

Yes, that is what our Physical Pentest module is for. We simulate realistic access attempts, for example as a supposed driver or subcontractor, and check whether the gate, access controls and warehouse areas stand up to them.

What does a pentest for a logistics company cost?

That depends on the scope: the number of sites, whether TMS, WMS and terminal control should be included, and whether physical testing and social engineering are part of it. After the free initial consultation you receive a fixed-price quote.

Sometimes all it takes is a fake delivery slip at the gate.

In the free initial consultation we clarify your scope and where you stand on NIS2 and KRITIS. After that you receive a fixed-price quote, with no strings attached.

All about the industry: access-granted.de/en/branchen/logistics

Book a consultation Get in touch

Contact

Address
Albert-Einstein-Straße 1, 95028 Hof
E-Mail
hello@access-granted.de
Phone
+49 9281 5918506

AccessGranted X GmbH · HRB 7266 · Hof (Saale)

Company

Services

Regulatory pentests

Industries

© AccessGranted X GmbH Last updated: September 18, 2026