The digital transformation is changing the way companies think and design their manufacturingenvironment. Both due to the increasing number of connections between IoT-Devices, tooling machines,and production lines and the phenomenon of the convergence of IT and OT, systems are becoming morecomplex than years ago. Organizational and cultural changes within manufacturing companies strengthenthis trend and form Industry 4.0 environments and cyber-physical production systems (CPPS). As thesesystems do not longer stay alone but are connected to each other and the company’s outside, the size of thepotential attack surface is increasing as well. Besides that, manufacturing companies, small and mediumsized in particular, are facing complex challenges based on lack of knowledge, budget, and time tounderstand as well as to interpret their current situation and risk level and therefore to derive necessarycounter-measures. Efficient as well as pragmatic tools and methods for these companies do not exist. Thispaper shows a research approach in which the company-specific set-up of Industry 4.0 environment andCPPS is characterized by its potential vulnerabilities. This enables companies to evaluate their risk potentialbefore setting up this kind of environments and to undJo,erstand the potential consequences more precisely.By doing so, companies can derive and prioritize important counter-measures and so to strengthen their levelof cyber-security efficiently. This will decrease the number of cyber-security attacks and increase thecompany’s competitiveness.