For organisations within the scope of ISO 27001, BSI IT-Grundschutz, KRITIS, NIS 2 or the EU AI Act. We take on the mandate, build the management system and secure the supply chain: at the depth today's maturity demands, with a handover state that carries tomorrow's.
Anonymised from real engagements. Form and depth are set on day one, not in sales.
Four guiding principles we measure every decision against, from the first discovery call through to the handover to your team.
We hand over what we build, with documentation and runbooks, so your team can carry on without us. We don't come to stay. But we'd be glad to come back.
Automate once, never manually again. Recurring work gets a script, a pipeline, an agent. Your time with us is finite; the automation stays.
What we build in other projects feeds our internal libraries: policy templates, risk catalogues, audit routines. You don't start from zero, you start at the level previous engagements have reached. And what we build with you, if it generalises, goes back into our Open Research repositories.
When a project outgrows us, we curate. No body-leasing, no partner pyramid. The accountability stays with us; the expertise comes from a pre-vetted network of individual specialists. Your contract stays one, your escalation chain too.
From long-term mandates through defined projects and recurring controls down to one-off tasks. A scale, not a catalogue.
The CISO role is rarely a hiring problem; it's a coverage problem. Board dialogue, audit steering and incident lead must work every day, not from the day the role is filled. We take on the role externally, at the depth of an internal hire, until you fill it — or permanently, if you choose not to.
The EU AI Act doesn't ask whether you deploy AI. It asks who is accountable, in which risk class, and with what evidence. We take on the role externally and, in parallel, build the foundation an internal successor can take over: inventory, classification, human oversight, documentation.
Most ISMS projects produce a binder, pass an audit and quietly die. The reason is almost always the same: documentation written for the auditor, not for the organisation that has to operate it. We invert that. The system you operate is the system that gets audited.
Cyber risk is decided in the boardroom long before it's mitigated in the SOC. The numbers brought up there often don't survive the first question from the management board. Ours do, built on named scenarios, recognised methodology (ISO 27005, FAIR-oriented) and visible assumptions open to challenge.
KRITIS isn't a compliance sprint, it's a continuous state: thresholds, sector-specific state of the art, biennial evidence, plus a regulator that sets the tone. Three parallel projects (KRITIS obligations, ISO 27001, B3S) is the expensive variant. We build it as one body of work, in which every requirement is anchored exactly once.
NIS 2 affects more organisations than most realise and makes personal accountability of the management body a structural element, not a footnote. The most expensive mistake is waiting for final clarity. Whoever decides applicability, training duty and measures now controls their own pace, not the regulator's.
Your attack surface stops nowhere near your firewall, and a supplier's certificate says little about your residual risk. Supplier security only becomes load-bearing when assessment, requirement and monitoring are graded by criticality: deep for a few, lean for the many.
Internal audits rarely fail on method; they fail on consequence. Insights nobody prioritises, residual risks nobody signs, remediation without a date. We invert that: neutral outside view, ISO 19011 as method, a report in the language the executive team uses to decide.
Through targeted upskilling of our team, we make sure every capability we need is in place and continuously developed. Academically and in practice.
We publish our tools and research on git.neomint.com/nm. Permissive licences, traceable commits, usable from the first release.
All repos on ForgejoSecure file transfer via PAKE. Browser-based wormhole frontend without server trust.
Reproducible VHDX containers for forensics labs and isolated malware analysis.
More repositories are in preparation. We only publish once a tool runs reliably, is documented and has proven itself across several of our projects.
We're not actively hiring right now. Even so: if you see cybersecurity as a craft and want to contribute to Open Research, write to us. We'll answer honestly about whether and when it could fit.
You describe your situation. We listen, ask follow-ups, and at the end we tell you honestly whether we're a fit. No sales funnel, no slides.