Services · Security for SMEs
Your second pair of eyes for security.
An independent outside view of whether your security works and whether the effort goes where it works.
00Two questions
Two questions show whether your security holds.
Those who run the measures rarely like to assess them. We look at both questions from the outside.
Effectiveness
Does your security work?
Whether the measures protect in operation and do not just exist in a concept.
Efficiency
Does the effort go where it works?
Whether budget and time land on the risks that matter.
01Why now
NIS2 requires assessing effectiveness.
Germany’s new BSI Act has applied since 6 December 2025. It requires not only measures but an assessment of whether they work – and holds management to account.
“Policies and procedures to assess the effectiveness of cybersecurity risk-management measures” (our translation)
Management must implement the measures and oversee their implementation – and is liable for culpably caused damage.
Management must take part in training regularly.
Applies to essential and important entities. Whether your company is in scope is something we clarify in the first hour.
02Effort
Not every vulnerability is a risk.
Scanners return thousands of hits, and only a small share gets exploited. The effort belongs where attacks succeed.
How likely is a known vulnerability to be exploited?
What made successful attacks possible?
03Approach
We do the testing ourselves: AI-native in breadth, with expert judgement in depth.
AI maps what is reachable. An expert judges every finding. Authorized penetration testing and red teaming, only under a written engagement.
What we do not take on
- No testing without written permission; before a transaction, only passive.
- No guarantee that a test finds everything – we deliver what is proven.
- No certificates we do not hold.
- No emergency response during live attacks; we refer you to the BSI list of qualified providers.
04Services
We support you from the board to the retest.
We also test web apps, APIs and AI integrations on request.
01Check effectiveness
Effectiveness review
Checks whether the § 30 measures are in place and work.
5–10 days
External attack surface
What an attacker sees from outside – confirmed and retested.
3–6 days
Identities and cloud
Accounts, permissions and configuration in Active Directory, Entra and M365.
5–10 days
Detection check
Which attack steps your systems notice.
3–5 days
02Steer the effort
Security posture
A picture of the key risks and duties under § 38 – counts as management training.
1–2 days + session
Vulnerability management
Risk-based by exploitability and criticality, with deadlines and metrics.
set-up 4–6 weeks
NIS2 and ISO 27001 roadmap
Scope, gaps and a plan with owners.
3–6 weeks
05Contact
Let’s talk about your execution.
Write to us directly or use the form. We reply personally.