A method monitors an industrial network. The industrial network is divided into at least two hierarchical levels each with a different hierarchical stage. At least one network component is respectively included for each hierarchical level. Each hierarchical level has at least one segment. Each segment comprises at least one network component of the respective hierarchical level. At least one component monitoring unit for monitoring at least one network component in the respective segment and/or at least one communication monitoring unit for monitoring communication in the respective segment is/are respectively included for each segment. A central monitoring unit is included in one of the segments in order to evaluate information for detecting attacks. At least one decentralized monitoring unit is respectively included in at least one of the other segments.