25+ years of independent information security consulting — from strategy and governance to compliance and architecture. We help SMEs and enterprises build security programs that work in practice, not just on paper.
Strategic and operational security consulting, built on 25+ years of framework expertise and real-world engagements across SME and enterprise.
Security strategy development, CISO advisory, policy and standards creation, board-level reporting, and security program design aligned with business objectives and risk appetite.
Structured risk identification, assessment, and treatment using ISO 27005, NIST RMF, and FAIR. Risk registers, treatment roadmaps, and residual-risk acceptance frameworks calibrated to your organisation.
Gap analysis and audit preparation for ISO/IEC 27001, NIST CSF, CIS Controls, NIS2, DORA, and nDSG. We translate regulatory obligations into practical, auditable control sets.
Design-level assessment of network segmentation, identity and access management, cloud controls, and defence-in-depth posture. Written findings with prioritised remediation guidance.
Scoped technical assessments — network, application, and social engineering — to validate controls and close gaps before attackers find them. Findings mapped to your risk register.
Incident response planning, playbook development, and tabletop exercises. Business continuity and disaster recovery integration to ensure your organisation can respond, contain, and recover.
MITRE ATT&CK maps how real attackers operate. We use it to show where your controls are strong, where the gaps are, and where to invest next.
For SMEs and enterprises alike, understanding the adversary lifecycle is not about running a SOC — it is about making better risk decisions. Each ATT&CK tactic represents a phase where controls either hold or fail. We use this structure during risk assessments and architecture reviews to identify which gaps carry the highest real-world exposure, so security investments go where they have the most impact.
↗ attack.mitre.orgMITRE ATT&CK® is a registered trademark of The MITRE Corporation. Used for reference under terms of use. · Each tactic maps to control gaps we assess during risk reviews and architecture audits.
Curated from authoritative, research-grade sources. Updated automatically every four hours.
Known Exploited Vulnerabilities — actively exploited in the wild (CISA catalog)
defend-it.ch is a Swiss information security consultancy with over 25 years of hands-on experience in security governance, risk management, compliance, and architecture. Our work spans financial services, healthcare, manufacturing, public sector, and critical infrastructure across the DACH region and beyond.
We work at the intersection of management and technology — where risk decisions are made. Whether you need a pragmatic ISO 27001 programme, an independent risk assessment, or a board-level security strategy, our advice is grounded in long practical experience across established frameworks: ISO 27001/27005, NIST CSF/RMF, CIS Controls, and CISM principles.
We are vendor-independent. We have no product affiliations, no reseller agreements, and no interest beyond giving you an accurate picture of where you stand and how to improve it. Our engagements are conducted in German and English.