Resilience as a Building Block for Business Success: Our Colleague Marlin Weis in Conversation with Business Circle

Marlin Weis, who serves as Lead 1st & 2nd Level SOC and Lead Innovation Bay at water IT Security, sat down with Business Circle to talk about cyber resilience. He explains why companies need to test their emergency plans regularly and how security innovations can be measured by economic viability and risk reduction. He also discusses why AI makes a real difference above all when it proves itself in day-to-day operations.

Mr. Weis, your background is in strategic and operational IT security consulting. Today at water IT Security, you are responsible not only for SOC operations but also for building the Innovation Bay. How has your view of cybersecurity changed since moving to the operator and corporate side?

My professional roots are in IT compliance, followed by several years in strategic and operational security consulting. Today I lead the SOC at water IT Security together with my colleague Sven. At the same time, I’m building our Innovation Bay, where we develop AI-powered solutions for cyber defense.

In my view, the biggest difference lies in responsibility. As a consultant, you make recommendations. As an operator, you live with the consequences, even at three in the morning when a critical alert comes in. This change of perspective has sharpened my view of the threat landscape considerably. In the SOC, I see every day how fine the margins are in many attacks. For us defenders, the rule is simple: we have to do excellent work every single day, while the attacker, unfortunately, only needs to land one lucky punch. Above all, I’ve come to realize that almost every company faces risks every day, often without knowing it, and some of those risks threaten its very existence. And yet it must not lose sight of its core business. That’s exactly why, in the Innovation Bay, we combine our day-to-day SOC experience with new solutions: whatever we develop has to prove itself in real-world operations.

water IT Security is an interesting success story in its own right. What have been the most important milestones for you, and since when (and why) has the company been present in Austria?

One important milestone was certainly our expansion into Austria in 2024. Our Vienna office is still our only location outside Germany, so it naturally plays a special role within water. Austria remains an exciting market with a lot of potential for us. That’s why we didn’t just want to be present there. We wanted to bring our expertise directly on site from day one.

In 2025, that commitment led straight to a Microsoft Visionary Award in the Security category, which confirmed we were on the right track. And of course, it’s also a great incentive to keep developing innovative, future-proof security concepts for the Austrian market.

In an interview with Handelsblatt, water IT Security CEO Alexander Benoit stresses that emergency plans are often outdated or play no role in day-to-day business. Sometimes they rely on tools that nobody knows how to use when it really matters. How can you tell whether resilience actually exists or merely looks good in presentations?

That’s exactly what we see in day-to-day SOC work as well: many emergency plans exist but are never put into practice. You can never be absolutely certain that an organization is truly resilient, but there are reliable indicators. Senior management is one of them. Can the executive team say exactly when the last tabletop exercise took place? Are there dedicated budgets for resilience projects and their further development? If resilience is seen merely as an IT issue, the foundation is usually missing.

It also comes down to the people who run the systems every day. Does the knowledge sit in outdated folders or in the heads of individual colleagues? Is the documentation up to date? When was it last revised, and why? Just as important is how those responsible feel. Do the administrators feel prepared for a crisis? Is there psychological safety within the team, and what is it based on?

An organization is only truly well prepared when all levels are involved and scenarios have been practiced within the past year. Mistakes also need to be discussed openly, and the lessons learned should already feed into the next exercise. Resilience is built through preparation, and through practice, practice, practice. It’s like your first drive on the Autobahn after passing your driving test: for most people, it’s pure stress. With every trip, the routine grows, and you act more calmly and confidently. That routine is the most reliable indicator of genuine resilience.

In cybersecurity in particular, a technically fascinating solution can be completely uninteresting from a business perspective. What does a security innovation need to deliver for you to say: this could become a business? Which metrics do you use?

That’s right: the most technically brilliant idea is often not the best solution for a company. For me, a security innovation has real potential when it solves two problems at once. It has to fix a security problem and also a problem in value creation or everyday work.

Authentication is a good example. For a university study, I surveyed companies from the German Mittelstand, Germany’s small and medium-sized enterprises. Many of them consistently used the same passwords, even for externally accessible systems, simply out of convenience. That borders on gross negligence, but it’s understandable. Using different passwords was a hassle, password managers were seen as cumbersome, and constantly entering credentials felt like a drag on productivity. Passkeys solve this problem. They are phishing-resistant and work entirely without passwords. Instead, users authenticate with biometrics or a hardware security key. This raises the level of security massively. At the same time, it eliminates forgotten passwords, resets and the helpdesk tickets that come with them. Security and productivity grow together.

Of course, not every necessary solution is this elegant. That’s why I evaluate innovations against clear metrics. First, economic viability: the ROI should be reached within a predefined period. This usually works when a new solution also replaces legacy systems and costs rise only moderately. To be honest, a good level of protection never comes for free. Second, I look at adoption. We measure how many employees are actually using a solution after a few months, from IT through to the business units. Without user adoption, every rollout fails, and it often takes genuine cultural change. Third, the impact on risk plays a major role. Is the number of incidents going down? Are mean time to detect and mean time to respond (MTTD and MTTR) getting shorter? A solution that doesn’t address a relevant risk is a waste of money, however good it is technically.

No interview would be complete without a question on AI. Attackers are using AI to scale phishing, social engineering and attack chains. Is this creating a new balance of power between attackers and defenders? Who will come out ahead?

AI has been a real passion of mine since 2022, both in my role as SOC Lead and in building our Innovation Bay. In the short term, the balance of power is indeed shifting. Inexperienced actors can suddenly launch far more sophisticated attacks, and professional groups are gaining unprecedented scalability. But cybersecurity has always been a game of cat and mouse: sometimes the attackers are ahead, then we catch up again.

For us, AI is above all an opportunity. Take the core problem of any SOC: the never-ending flood of security events. A single event can look completely harmless, and an attack pattern may only emerge in combination with other signals. Until now, limited capacity meant we could only take a closer look at the events that seemed most dangerous. Yet the inconspicuous signals that slip through the cracks are often exactly the ones preparing an attack. With AI, we can significantly widen our field of view, correlate events far more effectively and broaden the scope of our SOAR.

One thing is important to me: AI supports our analysts; it doesn’t replace them. The final assessment and the decision on countermeasures stay with humans. After all, AI can be wrong too, and attackers deliberately try to deceive it. Who will come out ahead in the long run? I believe the lead will keep changing hands. What matters is that defenders use AI just as consistently as attackers do.

NIS2, the CRA, DORA and other regulations are increasing the pressure on companies. Is more regulation really the right lever for greater cyber resilience? Or do we mainly need better implementation and more ownership without government interference?

I take a nuanced view. For me, cybersecurity is first and foremost part of business risk and therefore the responsibility of companies themselves. At the same time, we see every day that certain risks are simply ignored. That’s why I think regulations like NIS2 are fundamentally the right approach, including their national implementation. They make sure companies establish appropriate risk management, derive concrete measures from it and report incidents.

But regulation and certifications alone don’t create security. A certificate is always a snapshot and can never fully capture the complexity of an organization. What matters is what happens day to day: whether processes are actually followed, systems are maintained and emergencies are rehearsed. My conclusion: a clear regulatory foundation makes sense. Constantly adding new requirements on top of it achieves little, in my view, and ties up resources that are then missing elsewhere. I’d much rather see better implementation, meaning existing resources are channeled into measures that genuinely increase security and resilience.

Finally: if the audience took away just two sentences from your talk, what should they be?

Resilience isn’t built on paper, it’s built through practice. And those who have practiced act more calmly in a crisis and work more productively day to day.