Information Security & Risk Management

Security governance.
Risk-driven outcomes.

25+ years of independent information security consulting — from strategy and governance to compliance and architecture. We help SMEs and enterprises build security programs that work in practice, not just on paper.

Our Expertise Get in Touch
25+ Years consulting
ISO · NIST Framework expertise
CISM Aligned methodology
CH · DACH Operating region

What we deliver

Strategic and operational security consulting, built on 25+ years of framework expertise and real-world engagements across SME and enterprise.

🏛️

Information Security Governance

Security strategy development, CISO advisory, policy and standards creation, board-level reporting, and security program design aligned with business objectives and risk appetite.

⚖️

Information Risk Management

Structured risk identification, assessment, and treatment using ISO 27005, NIST RMF, and FAIR. Risk registers, treatment roadmaps, and residual-risk acceptance frameworks calibrated to your organisation.

📋

Compliance & Standards Audits

Gap analysis and audit preparation for ISO/IEC 27001, NIST CSF, CIS Controls, NIS2, DORA, and nDSG. We translate regulatory obligations into practical, auditable control sets.

🏗️

Security Architecture Review

Design-level assessment of network segmentation, identity and access management, cloud controls, and defence-in-depth posture. Written findings with prioritised remediation guidance.

🔐

Penetration Testing & Assessment

Scoped technical assessments — network, application, and social engineering — to validate controls and close gaps before attackers find them. Findings mapped to your risk register.

🚨

Incident Management & BCM

Incident response planning, playbook development, and tabletop exercises. Business continuity and disaster recovery integration to ensure your organisation can respond, contain, and recover.

Adversary tactics as a risk lens

MITRE ATT&CK maps how real attackers operate. We use it to show where your controls are strong, where the gaps are, and where to invest next.

For SMEs and enterprises alike, understanding the adversary lifecycle is not about running a SOC — it is about making better risk decisions. Each ATT&CK tactic represents a phase where controls either hold or fail. We use this structure during risk assessments and architecture reviews to identify which gaps carry the highest real-world exposure, so security investments go where they have the most impact.

↗ attack.mitre.org
TA0043 Reconnaissance Attackers profile your attack surface before striking. Controls: asset inventory, exposure management
TA0042 Resource Development Adversary capability build-up. Controls: domain monitoring, brand protection
TA0001 Initial Access Most common entry: phishing, exposed services, supply chain. Primary control gap for SMEs
TA0002 Execution Malicious code runs after access. Controls: application control, macro policies, EDR
TA0003 Persistence Attacker survives reboots and password changes. Controls: privileged access reviews, baseline monitoring
TA0004 Privilege Escalation Low-privilege → admin. Controls: least-privilege, patch management, hardening
TA0005 Defense Evasion Security tools bypassed. Risk indicator: over-reliance on single-layer controls
TA0006 Credential Access Passwords and tokens stolen. Controls: MFA, credential hygiene, PAM — high impact for SMEs
TA0007 Discovery Attacker maps your environment. Controls: network segmentation, least-privilege access
TA0008 Lateral Movement Spread to critical systems. Controls: segmentation, privileged access management
TA0009 Collection Sensitive data staged for theft. Controls: data classification, DLP, access governance
TA0011 Command & Control Attacker maintains remote access. Controls: egress filtering, DNS monitoring, proxy policy
TA0010 Exfiltration Data leaves your environment. GDPR/nDSG notification obligations triggered
TA0040 Impact Ransomware, destruction, DoS. Controls: BCM, offline backups, tested recovery plans

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. Used for reference under terms of use.  ·  Each tactic maps to control gaps we assess during risk reviews and architecture audits.

Current security landscape

Curated from authoritative, research-grade sources. Updated automatically every four hours.

// security feed loading…
Fetching latest intelligence…

⚠ CISA KEV

Known Exploited Vulnerabilities — actively exploited in the wild (CISA catalog)

Loading…

25+ years of applied security

defend-it.ch is a Swiss information security consultancy with over 25 years of hands-on experience in security governance, risk management, compliance, and architecture. Our work spans financial services, healthcare, manufacturing, public sector, and critical infrastructure across the DACH region and beyond.

We work at the intersection of management and technology — where risk decisions are made. Whether you need a pragmatic ISO 27001 programme, an independent risk assessment, or a board-level security strategy, our advice is grounded in long practical experience across established frameworks: ISO 27001/27005, NIST CSF/RMF, CIS Controls, and CISM principles.

We are vendor-independent. We have no product affiliations, no reseller agreements, and no interest beyond giving you an accurate picture of where you stand and how to improve it. Our engagements are conducted in German and English.

  • 25+ years of framework and consulting expertise (ISO, NIST, CISM)
  • Vendor-independent — no product commissions or referral relationships
  • CISM-aligned security governance and risk management
  • Bilingual delivery — German and English
  • nDSG / DSGVO compliant engagement handling
  • Calibrated advice for both SME and enterprise contexts
  • Post-engagement support and remediation verification available