Industrial Espionage and Know-how Protection in Small Firms

Why industrial espionage affects small businesses too

When people think of industrial espionage, they picture intelligence services spying on defense companies. Everyday life in small businesses looks different: a sales manager moves to a competitor and takes the customer list along. A supplier passes drawings on to a copycat. A prospect has the entire costing explained in three meetings and then orders elsewhere. The knowledge that distinguishes a business from its competitors sits in heads, files, and routines, and it can leave in many ways.

This article therefore asks: Which knowledge does a small or medium-sized business need to protect, and how much protection makes sense without hampering its own work? To answer it, we first clarify the terms, then look at the situation in figures, present a thinking model for the chain from leakage to harm, and weigh two perspectives. At the end come the legal minimum requirements and a test for your own business.

What is industrial espionage, and what is a trade secret?

German usage distinguishes two things. Economic espionage (Wirtschaftsspionage) is the state-directed spying on companies by foreign intelligence services. Competitive espionage (Konkurrenzausspähung), often also called industrial espionage, is spying by competitors, former employees, or other private actors. For the business, the difference matters little for the damage, but it does matter for whom to call in an emergency: where there are signs of state actors, the domestic intelligence authorities can be contacted; for private perpetrators, the police and civil courts.

What is protected has been governed since April 26, 2019, by Germany's Trade Secrets Act (GeschGehG), which implemented an EU directive from 2016. According to it, a trade secret is information that is not generally known, has economic value for that reason, and is protected by its holder through reasonable confidentiality measures. This can include formulas, designs, and source code, but equally costings, customer lists, sources of supply, and bidding strategies.

The third criterion is the important one. In the past, a recognizable intention to keep something secret was sufficient. Today, the holder must take action and prove it in a dispute. If you leave your costing openly on a shared drive, you will have a hard time later claiming it was a trade secret.

How common are espionage and data theft? The situation in figures

Every year, the digital association Bitkom surveys companies about data theft, espionage, and sabotage together with Germany's domestic intelligence service. For the 2026 study, 1,003 companies with ten or more employees were surveyed by phone. 96 percent were affected or suspected they were, and 67 percent could prove an attack with certainty. Bitkom estimates the damage at 211 to around 271 billion euros a year, 76 percent of which is due to cyberattacks. Cyberattacks on small businesses discusses these figures in detail. Here, the main interest is who is behind the incidents.

Three findings are revealing for small businesses. First, the share of companies that suspect foreign intelligence services rose from 28 to 37 percent. The most frequently named countries of origin were China (52 percent) and Russia (49 percent). Second, current and former employees remain a large group, both unintentionally and intentionally. Third, a considerable part of the outflow is analog.

The limits of the figures are clear. The study is based on self-reports, and the damage is an extrapolation. Only companies that could trace an attack can name perpetrators. Drawing on the German research project WISKOS, Knickmeier (2020) describes economic and competitive espionage as underestimated offenses, because those affected often do not notice incidents, do not report them, or do not press charges. The actual situation is therefore more likely to be understated than overstated.

The thinking model: the chain from leakage to harm

In the Journal of Marketing, Moorman, Kohli, and Jaworski (2026) presented a model that is useful for owners, even though it comes from marketing research. They base it on literature from eight disciplines and on interviews with 15 executives. Their basic idea: for leaked knowledge to harm a business, it must pass through four stages. The chain can break at each stage, and each stage has its own protection strategy.

An analogy from the restaurant business makes this tangible. A restaurant cannot hide its recipe, because every guest tastes the dish. For a competitor to profit from it, however, he must recognize what makes the taste, source the ingredients in the same quality, have a kitchen that cooks the dish equally well every evening, and find guests who switch because of it. Each of these stages is a hurdle. The recipe alone is rarely the lead.

The authors emphasize that stages 2 to 4 depend on the competitor's motivation and ability. A competitor busy with its own problems often does not use outside knowledge at all. For a business, this means: not every leak is harm, and protection need not start only at the first stage.

Seal off or work openly? Two perspectives

How much secrecy is right is answered differently. Both perspectives have good reasons.

The Bitkom figures and the law support the first perspective. Sadok, Welch, and Bednar (2020) also show that many cases of computer-enabled espionage stem from security failures and insiders, and consider purely technical solutions insufficient. They recommend a socio-technical approach that combines technology with a culture in which security is a matter of course.

Moorman, Kohli, and Jaworski (2026) support the second perspective. They describe nine hidden costs of sealing off in three groups: poorer decisions, for example because employees who do not know a plan cannot improve it; weaker execution, because coordination becomes cumbersome; and lost returns, because knowledge is not used or licensed. One example from their text: a business learns that a major customer plans to delist three products and does not tell its development team, which then keeps working on exactly those products.

I consider the second perspective the more useful one, without discarding the first. A small business depends on knowledge flowing quickly. If you protect everything, you protect nothing properly and slow yourself down. If, on the other hand, you clearly delimit the little knowledge that really makes up your lead, you can share the rest openly.

Protection that treats everything the same paralyzes the business and still does not protect what matters any better.

What the Trade Secrets Act requires of you

The law does not prescribe any particular measure. What is reasonable depends on the value of the information, its importance for the business, and customary practice. Practical guides from German chambers of commerce recommend taking and documenting measures on three levels.

Two points are often overlooked. First, copying by examination of a publicly available or lawfully acquired product, known as reverse engineering, is generally permitted under the law. If you want to exclude it, you must agree on that by contract. Second, the law protects whistleblowers who disclose secrets to expose unlawful conduct. Whistleblower protection describes how an internal reporting channel is set up.

The crown jewels test: limiting protection to what matters

From the thinking model and the law, I derive a test that I call the crown jewels test. It sorts a business's knowledge by how much protection it deserves, and only then sets measures.

1. Name the crown jewels

   Write down the five to ten pieces of information whose loss would harm your business for years: a formula, the logic of your costing, customer terms, a special production sequence. Anything that does not fit on the list needs no special protection.

2. Check leakage routes

   For each crown jewel, note where it is kept and who has access: drive, paper folder, the head of a single employee, supplier, customer. Think of analog routes, visits, and conversations.

3. Break the chain

   For each crown jewel, choose the stage at which protection costs least. Sometimes it is access, sometimes a contract, sometimes a lead the competitor would not catch up with anyway.

4. Document

   Record the measures in writing, with a date. This is the proof the law requires in a dispute.

5. Regulate departures

   Define what happens when employees leave: block access, return devices, a conversation about confidentiality. A large share of leaks occurs here.

Knowledge that exists only in one person's head is a risk of its own, and in both directions: it can go with that person to a competitor, and it can be lost with them. Securing knowledge before experienced employees leave describes how to keep it in the business. Knowledge management in sales shows how sales knowledge stays organized and accessible at the same time.

What follows beyond the individual case, and where the limits lie

Protecting know-how is a governance question, not purely an IT question. Who decides who has access, and who checks that the rules apply? The three-lines thinking from Corporate governance for small businesses transfers directly: the department protects its knowledge itself, a second person checks access rights, and occasionally someone looks in from outside. For new partners who see deep into your own processes, a prior check belongs to this, as described in Business partner due diligence.

The limits of this analysis are clear. The model by Moorman, Kohli, and Jaworski is a theoretical framework supported by 15 interviews and was developed for marketing knowledge. For technical knowledge that can be protected by patents, the trade-offs are partly different. The Bitkom figures concern companies with ten or more employees. There is hardly any reliable data for micro-businesses. The direction is nevertheless clear: most protection lies in order and responsibility, not in expensive technology.

Conclusion and a first step

To the guiding question: a small business does not need to protect everything, but the little knowledge that carries its lead. The figures show that leakage is common and often runs through people and paper, not only through networks. The law protects only those who take and document reasonable measures. At the same time, research shows that blanket sealing off has costs of its own. Targeted protection at the stage of the chain where it costs least, combined with open work on everything else, therefore makes sense.

The sober conclusion: the best protection for a small business is a lead that cannot be packed into a bag.

• Write down the five to ten crown jewels of your business.
• For each one, note where it is kept and who has access.
• Check whether employment and supply contracts contain confidentiality clauses.
• Define a fixed procedure for when employees leave.
• Record the measures taken in writing, with a date.
• Discuss with the team which information may be shared freely, so that protection does not become a brake.