Germany’s Smart City Index 2026 shows how quickly urban digitalisation is moving from individual projects towards interconnected infrastructure. Stuttgart has overtaken Munich at the top of the ranking, while the overall level of digital maturity among German cities continues to rise. Yet the development raises a question that extends far beyond Germany: as European cities become more connected, automated and data-driven, is their resilience developing at the same pace?

There is a new leader in Germany’s race to become the country’s smartest city. Stuttgart scores 92.8 out of 100 points in the Smart City Index 2026 published by digital association Bitkom, narrowly ahead of Munich with 92.0 and Hamburg with 91.5. Nürnberg follows with 91.3 and Düsseldorf with 90.9.

More important than the change at the top, however, is the broader direction of travel. The average score of the 83 German cities assessed has increased from 70.8 to 73.8 points. A place in the top ten now requires at least 85.5 points; in 2023, 76.6 were sufficient.

This is no longer simply a story about online municipal services or better broadband coverage. Urban digitalisation increasingly reaches systems that determine whether a city functions at all: transport, energy, communications, public administration, environmental monitoring and emergency response.

The same transformation is taking place across Europe. The EU is encouraging cities to share data, build local digital twins and integrate artificial intelligence into urban planning and infrastructure. Its Citiverse initiative, for example, is designed to connect digital urban ecosystems and support applications ranging from traffic and air-quality management to energy-grid optimisation, water and waste management. (Digitale Strategie Europa)

The implications for the security sector are profound. Once city functions become interconnected, urban security can no longer be separated neatly into physical security, cybersecurity and operational resilience.

The smart city is becoming a cyber-physical system.

Germany illustrates the scale of the transformation

Stuttgart’s position at the top of the German ranking is significant because its performance is unusually broad. It is the only one of the 83 cities assessed to rank among the top ten in all five categories examined: administration, IT and communications, energy and environment, mobility, and society and education. It leads the energy and environment category, while Hamburg achieves the maximum 100 points for mobility and also leads in IT and communications. Munich scores 99.8 in mobility.

The more revealing examples are perhaps found further down the table.

Mönchengladbach has climbed 18 places, supported in part by AI-based traffic management, a digital traffic-sign register and Wi-Fi on public transport. Hildesheim, another major climber, now uses electronic files, document-management systems and artificial intelligence throughout its municipal administration.

These examples illustrate what is changing beneath the language of “smartness”. A traffic signal is increasingly no longer an isolated piece of road equipment. A camera is no longer necessarily a closed video installation. An environmental sensor does not simply measure temperature or air quality.

Each can become an endpoint within a much larger architecture of sensors, gateways, communications networks, identities, databases, cloud platforms, analytical systems and automated decisions.

As these systems converge, seemingly minor components can become part of critical functional chains.

That distinction matters for security.

When a cyber incident becomes a physical event

Traditional IT security was largely concerned with the confidentiality, availability and integrity of information. Smart-city infrastructure expands the consequences of losing any of the three.

Manipulated sensor information can affect operational decisions. Compromised credentials may provide access to connected systems. A communications outage can prevent an operator from controlling equipment. Failure of a cloud-based platform may disrupt services far removed from the data centre where the original problem occurred.

In other words, digital incidents can acquire physical consequences.

This is also the direction in which European critical-infrastructure regulation has evolved. The EU’s Critical Entities Resilience Directive explicitly recognises growing interdependencies between infrastructures and sectors, as well as threats ranging from hybrid attacks and terrorism to natural disasters and climate-related events. Its definition of resilience extends beyond protection: critical entities should be able to prevent, withstand, respond to, mitigate and recover from disruptive incidents. (EUR-Lex)

Crucially, the CER Directive also requires Member States to coordinate its implementation with NIS2 because of the relationship between the physical security and cybersecurity of critical entities. (EUR-Lex)

That principle could almost serve as a security doctrine for the smart city.

The conventional separation between cyber and physical security becomes increasingly artificial once digital systems control physical processes.

Connected cities can also be safer cities

Yet it would be wrong to conclude that increased connectivity necessarily makes cities less secure. The same technology can significantly strengthen resilience.

The German Smart City Index provides useful examples.

Dortmund has created a city-wide climate-monitoring network consisting of 76 measuring stations. Its purpose is to detect heat stress and identify particularly affected neighbourhoods more precisely. Solingen’s SMARTKRIS project, meanwhile, is intended to develop crisis communication beyond conventional warning applications by providing location-specific information, contacts and hotline numbers while an incident is still unfolding.

This illustrates the positive security potential of smart-city technologies. Sensors can improve situational awareness. Data analysis can detect unusual developments earlier. Digital communications can deliver more targeted information. Connected systems can help authorities allocate resources more effectively during emergencies.

But this advantage creates a paradox.

The more important a digital service becomes during a crisis, the more serious its failure during that crisis becomes.

A smart city’s security architecture therefore cannot be based exclusively on keeping attackers out. It must assume that systems will occasionally fail, communications will be interrupted and individual components may be compromised.

The relevant question becomes not only how do we prevent disruption? but also how does the city continue to function after disruption has occurred?

That places redundancy, network segmentation, offline or local fallback functions, backup communications, recovery procedures and emergency operating modes at the centre of smart-city security.

Europe’s cyber exercises increasingly reflect this approach. During Cyber Europe 2026, more than 5,000 participants were involved in scenarios affecting interconnected European rail and maritime transport systems. The exercise focused not only on technical incident response but also on information sharing, coordinated situational awareness and maintaining essential services during a major cyber crisis. (ENISA)

For cities, the lesson is important: resilience is rarely created inside a single device or platform. It emerges from the interaction between technology, organisations and operators.

Europe is regulating the ecosystem, not only the operator

This is where the European context becomes particularly important.

NIS2 significantly broadens the range of sectors subject to cybersecurity risk-management and incident-reporting obligations. Alongside energy, transport, water and digital infrastructure, its scope includes areas such as wastewater, electronic communications and public administration at central and regional level. Supply-chain security and vulnerability management are explicitly part of the framework. (Digitale Strategie Europa)

Germany implemented the directive through its NIS2 implementation legislation, which entered into force on 6 December 2025. The German government describes the objective as strengthening the resilience of important organisations and implementing common European cybersecurity standards across a much broader range of sectors. (Bundesregierung)

Germany has also moved on the physical-resilience side. Its KRITIS-Dachgesetz entered into force on 17 March 2026 and establishes a national framework for strengthening the physical resilience of critical facilities. (Gesetze im Internet)

The direction is therefore clear: Europe is gradually constructing a security framework in which cyber resilience, physical resilience and continuity of essential services have to be considered together.

For smart cities, however, regulation of operators is only one part of the equation.

The other is the technology itself.

The supplier becomes part of the security perimeter

Municipalities rarely manufacture their own cameras, IoT sensors, access-control systems, network equipment, traffic platforms, command-and-control software or cloud infrastructure.

They buy them.

That means the traditional boundary between an organisation and its suppliers becomes less meaningful. A technology provider whose platform manages thousands of devices or provides remote access to urban infrastructure effectively becomes part of the city’s security architecture.

This shifts the criteria for public procurement.

Functionality and purchase price remain important, but they are no longer sufficient. Cities increasingly need to ask how long a product will receive security updates, how vulnerabilities are handled, whether communications and credentials are adequately protected, whether events can be logged and audited, whether networks can be segmented and whether the system can continue operating when its central cloud connection disappears.

Vendor lock-in also acquires a security dimension. A municipality that moves a critical function onto a proprietary platform is making decisions not only about technology but also about future migration options, operational dependence and control over its data.

Open interfaces and interoperability therefore become resilience issues as much as technology-policy issues.

This is particularly relevant as Europe seeks to make smart-city technologies reusable across municipalities. Connecting local digital twins and urban data environments can generate substantial economic and operational benefits. But common infrastructures also require common assumptions about authentication, data integrity, access rights, software maintenance and incident response.

Interoperability without security would merely make vulnerabilities interoperable as well.

The Cyber Resilience Act changes the equation for manufacturers

The EU’s Cyber Resilience Act adds another layer.

Unlike rules primarily directed at operators of essential services, the CRA establishes horizontal cybersecurity requirements for hardware and software products with digital elements placed on the European market. Manufacturers are required to address cybersecurity throughout the product lifecycle, including vulnerability handling. (Digitale Strategie Europa)

The timing is particularly relevant in September 2026. From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe security incidents affecting products with digital elements. An initial warning must generally be submitted within 24 hours of awareness, followed by more detailed notification requirements. The CRA becomes fully applicable on 11 December 2027. (Digitale Strategie Europa)

ENISA has meanwhile published a Secure by Design and Default Playbook intended to translate the principle into practical product-development measures throughout a product’s lifecycle. (ENISA)

For the European security industry, this is more than another compliance exercise.

It changes the competitive environment.

Security by design, long-term vulnerability management, transparent support periods and secure default configurations are moving from desirable product characteristics towards conditions for participation in Europe’s digital market.

Manufacturers serving smart cities will therefore increasingly be judged not only by what their products can do on installation day, but by whether those products can remain secure throughout years of operational use.

Physical security is being drawn into the same architecture

This development is especially important for the traditional security industry.

Video surveillance, access control, intercom systems, perimeter protection, alarm management and emergency communications have historically been described as physical-security disciplines. But almost all are increasingly IP-based, remotely manageable and integrated into broader platforms.

A network camera is both a security sensor and an IT endpoint. An electronic access-control system is simultaneously a physical barrier, an identity system and a database. An intercom can be part of an emergency-management architecture. A command-and-control platform can connect video, intrusion detection, fire alarms, communications and external data sources.

The more these systems are integrated into smart-city platforms, the less useful the old distinction between physical security and cybersecurity becomes.

This has consequences for manufacturers and integrators. Installation expertise alone will not be enough. Network architecture, identity management, secure remote access, software lifecycle management, cybersecurity monitoring and incident-response capability increasingly become part of the physical-security proposition.

It also creates opportunities. Companies capable of combining operational technology, physical protection and cybersecurity are moving closer to the strategic core of urban infrastructure.

The security market is therefore not simply gaining another vertical called “smart cities”. Smart-city development is changing what a security system is.

But Germany’s Smart City Index is not a security ranking

That distinction also exposes an important limitation of digital-city rankings.

Bitkom’s Smart City Index is unusually detailed. Its 2026 edition evaluates 83 German cities using 14,442 data points, 39 indicators and 174 individual parameters across administration, IT and communications, energy and environment, mobility, and society and education.

Cybersecurity and resilience, however, do not constitute a separate top-level category.

That is not a criticism of the methodology. The index sets out to measure municipal digitalisation, not to certify urban cybersecurity.

But the distinction matters.

A highly digital city is not necessarily a highly resilient city.

A municipality could deploy sophisticated sensors, digital public services and intelligent mobility platforms while simultaneously accumulating poorly documented devices, outdated software, excessive privileges, fragmented supplier relationships and weak recovery procedures.

Indeed, digital maturity and cyber resilience could theoretically diverge.

This suggests that Europe’s smart-city debate may eventually need a second set of indicators alongside digitalisation.

How quickly can a municipality restore a critical system? Which services have independent fallback capabilities? How comprehensively are connected assets documented? Are networks segmented? How quickly are vulnerabilities remediated? How frequently are cross-organisational crisis exercises conducted? Are suppliers required to guarantee security support for the expected lifetime of their systems?

These indicators may sound less attractive than AI-controlled traffic or a municipal digital twin.

In a crisis, they may prove considerably more important.

Germany as a European test case

Germany therefore offers a useful case study for a wider European transformation.

Its leading cities demonstrate that digitalisation is becoming more sophisticated and more deeply embedded in urban operations. At the same time, the German implementation of NIS2 and the introduction of the KRITIS-Dachgesetz show how European requirements for cyber and physical resilience are beginning to influence the national security framework. The CRA adds obligations at product level.

Taken together, these developments point towards a new model of urban security.

The city can no longer be protected by securing buildings, networks and databases separately. The object requiring protection is increasingly the system of systems connecting them.

That is also why Europe’s plans for shared digital twins, common infrastructures and reusable smart-city solutions deserve a security discussion from the beginning rather than after deployment. The economic logic of shared platforms is compelling: cities should not have to reinvent every digital service independently. But shared technological foundations can also create shared dependencies.

Scale is therefore both Europe’s opportunity and its security problem.

From smart city to resilient city

The Smart City Index 2026 shows that German cities are becoming more capable digitally. It does not tell us whether they are becoming equally capable of absorbing disruption.

That may become the more important question over the next decade.

The European regulatory framework is already moving towards this broader concept of resilience. NIS2 addresses cyber-risk management and incident response. The CER framework addresses the resilience of critical entities against a wider range of physical and operational threats. The Cyber Resilience Act moves security obligations towards the manufacturers of the digital products on which modern infrastructure depends. (EUR-Lex)

For cities, the strategic consequence is straightforward: cybersecurity cannot be added after digitalisation. Nor can physical security be treated as a separate layer protecting a fundamentally digital operating environment.

Both have to be designed into the architecture.

For the European security industry, that creates a market in which integration capability, interoperability, secure product lifecycles and resilience will increasingly matter alongside conventional performance specifications.

And for municipalities, it changes the definition of technological leadership.

The most advanced smart city will not necessarily be the one with the largest number of connected sensors, the most sophisticated digital twin or the greatest use of artificial intelligence. It will be the city that can exploit those technologies without becoming dependent on their uninterrupted operation.

Europe’s competition to build smarter cities is therefore acquiring a second discipline: the competition to build more resilient ones. Only when connectivity, security and continuity develop together does a smart city become a secure city.