CSO Interview: Dr. Alexandra Forster on Global Threats, NIS2, and Crisis Management at Bayer

Dr. Alexandra Forster, Head of Corporate Global Security at Bayer AG

© Alexander Vejnovic, das-fotostudio-duesseldorf.de

GIT SECURITY International: Dr. Forster, you are Head of Corporate Global Security at Bayer. To start, could you please introduce your unit? 

Alexandra Forster: Corporate Global Security is the central function responsible for corporate security at Bayer. Our mission is to establish a common understanding of security worldwide: with clear standards, robust processes, and a professional assessment of the Group’s relevant risks. We support our three divisions—Crop Science, Pharma, and Consumer Health—in areas such as site and travel security, event security, personal protection, crisis management, threat intelligence, and investigations.
A key aspect of this is the integration of governance and operational feasibility. A standard is only effective if it actually works in practice at a production, research, or administrative site. To achieve this, we collaborate with regional security managers and local teams in the countries where Bayer operates. At many sites, we work with external security service providers. This is precisely why it is crucial that roles, expectations, and quality standards are clearly defined.

How do you define your own role? 

Alexandra Forster: I see my role as providing guidance, setting priorities, and ensuring our team remains capable of taking action. Today, security is no longer a static protection concept but rather a continuous process of adaptation. Amid the company’s current transformation, it’s particularly important to me to support my team so that we can focus on what really matters: protecting Bayer’s people, sites, information, and ability to act.

How does Corporate Global Security at Bayer collaborate with other divisions within the company? 

Alexandra Forster: Corporate Security no longer operates in silos. Many security issues arise precisely at the interfaces—for example, between physical security, cybersecurity, compliance, legal, HR, safety, and risk management. We therefore work closely with these functions on both a strategic and operational level. Strategically, this involves joint risk assessments, governance, and setting priorities. Operationally, we work in cross-functional teams on issues such as product counterfeiting, threat assessments, travel safety, the protection of sensitive information, and AI-enabled fraud attempts.
For me, it’s crucial that collaboration doesn’t just begin when a crisis strikes. We need resilient relationships, clear escalation pathways, and a shared understanding of who contributes what in which situation. Only then can we respond quickly and effectively.

Bayer is a life sciences company with production and research sites in approximately 80 countries around the world. Industrial espionage, politically motivated sabotage, cyberattacks, etc., are issues that pharmaceutical companies in particular must address. Could you give us some insight into which threat scenarios are most relevant for Bayer? 

Alexandra Forster: For a global life sciences company like Bayer, the threat landscape is very complex. From a corporate security perspective, we focus on several key risk areas. First, there is the protection of our employees, particularly when traveling, on assignments, at events, or in countries with heightened political instability. Geopolitical tensions, social unrest, natural disasters, or regional conflicts can very quickly impact our ability to operate.

Second, protecting our sites and supply chains plays a central role.

Production and research sites must not only be physically protected but also assessed for their resilience. This includes access controls, vendor management, emergency planning, and the ability to quickly resume operations in the event of disruptions.
Third, we are concerned with the protection of sensitive information, intellectual property, and research data, as well as the integrity of our products. Counterfeit products in the pharmaceutical sector are not only an economic risk but can also directly affect patient safety. Cyberattacks are a significant part of the overall risk landscape. Technical defense is the responsibility of the relevant cybersecurity functions. From a corporate security perspective, however, it is crucial for us that physical security, situational awareness, crisis management, and cybersecurity work closely together.

Many of your facilities are classified as critical infrastructure. There are currently major regulatory changes in this area—key terms include NIS2 and the KRITIS Framework Act. How do you view this situation—and to what extent do you need to “upgrade” your systems, so to speak? 

Alexandra Forster: The regulatory requirements surrounding critical infrastructure, NIS2, and the KRITIS umbrella law are highly relevant to us. Even though my area of responsibility lies primarily in physical security, these topics cannot be viewed in isolation today. Resilience can only be achieved when physical security, cybersecurity, business continuity, crisis management, and governance are seamlessly integrated.
For corporate security, this means above all that we are reviewing existing security concepts, clarifying responsibilities, and taking a very close look at interfaces. This includes access controls, service provider management, situation assessment, emergency procedures, and regular drills.
I view the new requirements less as a mere compliance issue and more as an opportunity to consistently further develop our security architecture. It is crucial that regulatory requirements are not merely documented but actually take effect in the event of an emergency.