Near-Miss Incident
Incident averted — not subject to notification
TL;DR
A near-miss incident is an event that could have impaired security but was detected and averted in time. Under NIS2 it is NOT subject to notification, but it is valuable for internal lessons learned.
What is a near-miss incident?
Examples:
- Phishing email with a 2% click rate — the IDS blocked all connections
- Brute-force attack on the VPN — prevented by conditional access
- Insider attempt at data exfiltration — blocked by DLP
Practical example
An insider tries to copy 50,000 customer records onto a USB stick. The DLP tool blocks the action and raises an alert. No data left the organisation — a near-miss incident, not an incident subject to notification, but the insider procedure is started.
Notification obligations in Germany and Austria
In both jurisdictions, the NIS2 notification obligation applies exclusively to significant (cyber) security incidents. A near-miss incident averted in time does not reach that threshold and therefore triggers no notification obligation. Voluntary notification of relevant information remains possible in both countries (Art. 30 NIS2 Directive).
Germany
Only significant security incidents under § 32(1) of the German BSI Act (BSIG) (2025) must be notified — in three stages within 24 hours (early warning), 72 hours (notification with an initial assessment) and one month (final report) to the joint reporting office of the Federal Office for Information Security (BSI) and the Federal Office of Civil Protection and Disaster Assistance (BBK). Under § 2 no. 11 BSIG, an incident is significant only if it has caused or is capable of causing severe operational disruption or financial losses, or if it affects others through considerable material or non-material damage. An averted near-miss incident does not meet this test.
Austria
Only significant cybersecurity incidents under § 34 in conjunction with § 35 NISG 2026 (BGBl. I Nr. 94/2025) must be notified — likewise in three stages within 24 hours, 72 hours and one month to the competent CSIRT. Under § 35(1) NISG 2026, a cybersecurity incident is significant only where there is severe operational disruption, severe financial loss, or considerable material or non-material damage to third parties. Near-miss incidents do not fall within this.