The CISO Who Started With Economics, Not Code

Key points

• Körber AG, a German technology and manufacturing group with around 13,000 employees across 100 locations worldwide, employs Andreas Gaetje as its chief information security officer (CISO, the executive responsible for protecting a company's digital systems).
• Gaetje began his career in the mid-1990s drawn by economics and business politics, not computers, joining a consulting firm before moving into the finance sector.
• The global shortage of trained cybersecurity workers was estimated at between 2.8 million and 4.8 million people in 2025.
• Gaetje's single non-negotiable hiring requirement is a genuine desire to keep learning, ranked above formal qualifications or years of experience.
• He draws a firm line between ethical hackers, who probe systems with permission to find weaknesses, and criminal hackers: the first group he would hire, the second he would not.

Körber AG makes the industrial machines that sit behind products most people never think about. Andreas Gaetje, Körber's CISO, told SecurityWeek: "Probably every vaccine you ever received has been through our machines." Körber supplies the suppliers. Nobody outside the industry knows the name, which is common for companies that quietly hold a lot of critical infrastructure together.

Gaetje's route to the top of cybersecurity at a company like that is genuinely unusual. Economics first, code never.

How does someone end up running cybersecurity without a technical background?

Practice, mostly. Gaetje entered the workforce in the mid-1990s, when email was replacing the fax as the default way businesses communicated. He needed money. He spotted that IT was becoming the engine of commerce and looked for a role where business thinking and technology could overlap. A consulting firm gave him that. An insurance company gave him something more valuable: a seat in the audit department, where he learned how organisations actually function and where they break.

At the time, information security (protecting a company's data and systems from attack or misuse) was mostly a compliance exercise. Tick boxes on a regulator's checklist. That changed fast.

The 2010s brought WannaCry and NotPetya, two global cyberattacks in which malicious software spread across entire corporate networks and caused billions of dollars in losses. Suddenly security wasn't a compliance question. It was a survival question. Gaetje was already positioned to bridge the gap between the board and the security team. By 2018 he was CISO at Körber IT Solutions; a year later he held the same title at the parent group.

The failure mode for most security programmes is the one his career accidentally avoided: a security leader who speaks only to engineers. Business literacy isn't a nice-to-have.

What career advice shaped him?

"Don't stay too long in a single company or a single industry sector," he told SecurityWeek. It's the advice he credits with bringing him to Körber. Different industries carry different risk profiles, and a mind stuck in one environment stops adapting. Attackers don't.

Should you worry about who's staffing these teams?

Yes, and the numbers support it. The global cybersecurity talent shortage was estimated at between 2.8 million and 4.8 million in 2025. Our 6 July piece argued that the real problem isn't a shortage of trained people but a shortage of people who've actually practised under fire. Gaetje's hiring philosophy lands in the same place: experience is welcome, curiosity is mandatory. He cannot train someone to want to learn.

For anyone running workloads on industrial control systems or operational technology networks, the broader point matters. The machines that make medicines and package food depend on security teams like his keeping criminals out. Körber's profile as a supplier to suppliers makes it exactly the kind of target that shows up in attacks on manufacturing PLM systems we reported in June.

The thing a reporter on this beat notices: Gaetje's career is a useful counterargument to the certification-first hiring orthodoxy, but the shortage is structural. Curiosity doesn't scale fast enough to close a four-million-person gap.