Your security posture —
not just documented,
actively defended.
A good security architecture is not enough if no one is watching. With Managed Security you get continuous monitoring, threat detection, and structured incident response — so you can meet the NIS2 72-hour reporting deadline and maintain DORA-compliant documentation. Your dedicated contacts know your environment — no anonymous ticket operations.
How Managed Security works
No black-box operations. A linear, transparent flow — from detection to reporting.
Who Managed Security is for
Managed Security is for organizations that have built a sound security architecture — and want to ensure it remains effective day to day.
No internal security team
Your internal IT team is not staffed for ongoing security monitoring, but you don't want a full-service agency with opaque service scope — you want a specialized consultancy with dedicated contacts that is directly accountable to you. As a first step, we recommend an NIS2 baseline assessment to determine the concrete monitoring need.
NIS2 and DORA reporting obligations
NIS2 requires an early warning within 24 hours and a full report within 72 hours. Without continuous detection, meeting these deadlines is impossible — audit-ready documentation included.
After an incident
After an incident or architecture overhaul, you want to ensure that new attacks are detected early — with a clearly defined incident response process and escalation path.
Critical cloud systems
You operate critical systems in the cloud and don't want to learn about an incident from a BSI call. Forensics and compliance documentation are standard with us.
What we provide
Managed Security is not a black box. You always know what is being monitored, which rules are active, and how we respond to an incident.
Continuous Monitoring
Ongoing surveillance of your environment for security-relevant events — based on Microsoft Sentinel and Microsoft Defender XDR
Incident Detection & Triage
Manual review and classification of alerts by severity — suppression of false positives, prioritization by asset criticality, and focus on genuine threats
Incident Response
Structured response to incidents — containment of affected systems, briefing of management, and documentation for NIS2 reporting obligations and insurers
Regular Reporting
Monthly status reports with an overview of detected events, trend analysis, and recommendations for the next period
Compliance Evidence
Audit-ready records of all monitoring measures and incident responses — for NIS2, ISO 27001, BSI IT-Grundschutz, and external auditors
Quarterly Reviews
Regular review of the monitoring strategy, tuning of detection rules, and joint assessment of the current threat landscape
How we work together
Managed Security starts with an onboarding phase in which we understand your environment, your risks, and your reporting obligations — only then do we start operations.
Onboarding and Scope Definition
2–3 weeks- Capture environment and risks
- Define monitoring scope
- Set up technical integrations
- Clarify escalation paths and contact persons
Ongoing Operations
Continuously- Continuous monitoring
- Maintain and tune detection rules
- Incident response per agreed procedure
- Regular reports
Quarterly Reviews
Every 3 months- Review threat landscape together
- Adapt monitoring scope to changes
- Update detection rules
- Review escalation paths
What Managed Security is not
We are a specialized consultancy, not a 24/7 NOC with hundreds of analysts. Our approach is deliberately different: personal, transparent, with dedicated contacts, and tailored to regulated organizations — automotive suppliers, FinTech companies, and critical infrastructure operators — in Germany.
Dedicated contacts — direct access to the principal, not an anonymous ticket system
No anonymous ticket operations without context
Services and response times clearly agreed
No lock-in contracts with opaque scope
We complement and support where it makes sense
Not a replacement for an internal security team
Frequently asked questions
Can I transfer responsibility for information security to a service provider?
No. Under NIS2 and DORA ultimate responsibility stays with executive management and cannot be delegated. What can be outsourced is the operational work. For that to hold up, a provider has to execute traceably, document decisions and deliver evidence that stands up in an audit as proof of due diligence.
Is an E5 licence enough to meet NIS2?
No. A licence provides capabilities, it does not configure them. In practice, security that has been paid for is often not switched on, or applies to only part of the accounts. NIS2 asks for effective measures and evidence of them, and both only come about through configuration, operation and documentation.
How do I tell whether my security provider works in an audit-ready way?
Three questions usually suffice. Can they state, per control, what is demonstrably met and where the evidence sits? Does operation run inside your own tenant, documented well enough that your team could take it over? And do they deliver reports an auditor can read, with traceable data provenance, rather than dashboards with no evidentiary value?
Request Managed Security
Tell us briefly about your environment and what you're looking for — we'll get back to you within one business day for an initial conversation. Personal, reliable, no detours.
No obligation. No sales pitch. Just clarity.