Cybersecurity Insights
Read new articles, analyses, and best practices from our experts. We cover information security, IT security, and the cyber threats you face.
Analyst Triage in the SecTepe Sandbox: IoC Confidence Tiers & an Explainable Score
The SecTepe Sandbox sorts every indicator into three confidence tiers and gives the reason. Its explainable 0–100 score states why it is what it is. It does not fake a malware probability.
New Assessment Report in SecTepe.Core: Complete Gap Analysis & Consistent Multi-Format Exports
SecTepe.Core has a reworked compliance assessment report. The gap analysis lists every requirement and adds an action plan by type. CSV, XML, PowerPoint, Word and Excel now share the same structure.
AI Policy Optimization & Formatted DOCX Mirror Documents in SecTepe.Core
AI-assisted policy optimization in SecTepe.Core now works in the language of the policy. It is unlocked for free tenants and no longer truncates. Mirror documents export as cleanly formatted DOCX.
Bilingual Trust Center & Automated DE/EN Release Notes in SecTepe.Core
The public white-label trust center of SecTepe.Core is now bilingual (DE/EN), with accessibility fixes. Release notes are now written in both languages automatically. Branch names no longer appear in the published text.
Unified Audit Management in SecTepe.Core With a Drag-&-Drop Timeline
Supplier audits now live in the central audit management of SecTepe.Core. You can reschedule the audit timeline with the mouse. A framework/chapter scope picker makes ISMS audit planning precise.
BSI C5 Audit Readiness: Signed Evidence Bundles & Data-Residency Attestation
The SecTepe platform generates monthly C5 evidence bundles signed with Cosign and stores them in an Object-Lock bucket. A written data-residency attestation proves where customer data physically resides.
Leak Dataset Module in SecTepe.Core: Investigate Data Exfiltration Forensically
The new leak dataset module in SecTepe.Core shows what a dump really contains. It assigns affected systems and third parties and generates rotation documentation. Learn why a failed search is not an all-clear.
Leak Ingest: Evaluating Ransomware Leaks in a GDPR-Compliant Way (Art. 33/34)
SecTepe.Core.CTI ingests and evaluates data from ransomware leak sites in a controlled way. It is opt-in per domain, runs only over Tor and uses ClamAV before extraction. Credentials are detected without clear-text export, and a bilingual victim warning report follows.
Link Nextcloud Files Directly in Six Applications
The SecTepe platform adds a ☁ Nextcloud button to Vikunja, Redmine, Wiki.js, Moodle, TheHive, and Zammad. It works same-origin via OAuth2 ForwardAuth and is strictly read-only. No upstream plugin system is needed.
Supply-Chain Hardening: Digest Pinning and 334 Verified Image Pins
The SecTepe platform makes its supply chain verifiable. 123 of 128 base images are pinned by SHA-256 and GitHub Actions by commit SHA. All 334 image pins are reconciled, the concrete answer to the NIS2/ISO 27001 supply-chain question.
SecTepe Collector & DFIR Portal: Forensic Acquisition Without a Login Barrier
The Velociraptor-based SecTepe Collector gathers artifacts from Windows, Linux and macOS. A two-part portal offers login-free upload and an SSO analyst console. It turns the artifacts into a timeline, IOCs, and a PDF case report.
sectepe-vmi: Agentless Out-of-VM Malware Analysis in the SecTepe Sandbox
The SecTepe Sandbox uses the VMI engine sectepe-vmi to observe malware entirely from outside the guest. It needs no in-guest agent and no kernel driver. On Windows, it leaves no artifact on disk.
AI Pentest Agent in SecTepe SnapScan: Autonomous, Agentic Penetration Testing
The new agentic AI scan in SecTepe SnapScan runs a pentest headless. It offers cold resume, automatic cost downgrade, and a coverage ledger. The cockpit shows an attack-chain timeline.
Active Exploitation & CTI-Triggered Rapid Response in SecTepe SnapScan
SnapScan exploits vulnerabilities provably, in three graduated modes with full logging. When a new critical CVE appears, a CTI trigger retests the entire engagement fleet in a single call.
From Threat News to Auditable Governance Evidence
SecTepe.CTI.Compliance turns ~62 sources into classified compliance reports and carries them into SecTepe.Core as evidence. It uses a four-axis classification. Framework mapping covers NIS2, DORA, ISO 27001, BSI, GDPR, TISAX, PCI-DSS, and HIPAA.
Agentic Layer in SecTepe.Core.CTI: Governed MCP Server, NLQ, Report-AI & Graph
SecTepe.Core.CTI gives AI agents and analysts natural language and governed tool access to the threat intelligence platform. It uses an MCP server, NLQ, Report-AI, and a graph service. The model never gets write access.
CTEM in SecTepe SnapScan: Continuous Attack-Surface Validation & Passive OSINT
SnapScan closes a Continuous Threat Exposure Management loop with scheduled repeat scans. A purely passive OSINT footprint engine complements it. It can also scan .onion targets over Tor.
MCP Findings Export & Service Keys: SnapScan Results for SOAR and AI Agents
SecTepe SnapScan exposes its pentest findings via a read-only Model Context Protocol server. Findings are enriched with CISA KEV and EPSS. Tenant-bound, hashed service keys secure access.
In-Network Runner & Hardened Appliance: Pentesting From Inside the Customer Network
SecTepe SnapScan enables internal penetration testing with engagement-bound runners. They use a signed scope, reject out-of-scope targets locally, and bring an AD toolkit and kill switch. An on-host agent adds human-in-the-loop control.
Supply-Chain Advisory: One JSON, Three Repositories, Always IOCs
SecTepe turns a structured supply-chain advisory, such as a malicious npm/PyPI release, into a classified, framework-mapped report. Three repositories share one canonical JSON. IOC forwarding is guaranteed.
Director Liability under §43 GmbHG and NIS-2: Why 'Cyber is IT's Job' Can Lead to Personal Bankruptcy in 2026
§43 GmbHG, §93 AktG, and NIS-2 Art. 20 cement personal management liability for cyber security. Learn which evidence every director should have on the desk.
Cyber Insurance 2026: Why Insurers Increasingly Decline – And How to Prepare
Cyber policies are getting more expensive, narrower, and more demanding. Learn which technical minimums insurers expect in 2026 and how to prove them cleanly.
Hospitals & Critical Infrastructure: B3S, NIS-2 Extension, and Smart Use of KHZG Funds
German hospitals face combined pressure in 2026. B3S obligation, NIS-2 extension to all hospitals, ePA connection and a ransomware wave hit at once. Here is how to prioritize KHZG funds wisely.
NIS-2 Ready: Health Monitoring, Audit Log, and Alert Rules in the Mail Security Platform
These are the operational building blocks a mail security platform must ship. They let it meet the NIS-2 requirements on detection, reporting, and response technically.
Wazuh SIEM, OpenBao Vault, and Coraza WAF: The Defensive Stack in SecTepe.Comm
Wazuh as SIEM, OpenBao as secrets vault, and Coraza as WAF together form a full defense-in-depth stack. It is self-hosted and auditable.
Identity & Access Management with Keycloak and an AD Connector
A central Keycloak identity provider with OIDC, SAML, MFA, and an AD connector unifies hybrid environments. The result is real single sign-on without vendor lock-in.
DORA for SaaS Providers and Bank Suppliers: What 'Critical ICT Third-Party Providers' Must Deliver in 2026
DORA doesn't only apply to banks. Any SaaS provider, IT service provider, or FinTech with financial customers gets pulled in. Learn what 'critical ICT third-party providers' must deliver technically and contractually.
Matrix and Jitsi: End-to-End Encrypted Team Communication Without a Cloud Gateway
Matrix/Synapse with the Element client and Jitsi Meet together replace the Slack/Teams/Zoom stack. The setup runs federated or isolated, with real end-to-end encryption.
Four-Eyes Principle and Forensic Archive: Two Building Blocks Almost Every Audit Asks About
A four-eyes approval workflow for mail releases works together with a WORM-capable forensic archive. Both proactively cover typical findings from ISO 27001 and NIS-2 audits.
M&A Cyber Due Diligence: What Buyers Probe in 4 Weeks – And Where Deals Break
Cyber due diligence is a workstream of its own in 2026 M&A processes. Learn which findings depress purchase price or kill deals, and which platform evidence builds trust quickly.
German Mid-Market Machinery: NIS-2 Extension, IEC 62443, and Industrial Espionage Risk
The German machinery mid-market faces double pressure in 2026. The NIS-2 extension hits many unexpectedly, while industrial espionage grows. Here is how to tackle OT security and IEC 62443 in a structured way.
n8n + Bus Gateway: Event-Driven Automation as the Glue of the SecTepe.Comm Platform
n8n as workflow engine plus a custom bus gateway turn the platform building blocks into real end-to-end workflows. No Zapier dependency is needed.
Outbound DLP: Effectively Preventing Data Loss in Email
A modern mail security gateway detects PII, credit card numbers, IBANs, and API keys in outbound emails. A four-eyes release reduces the error rate.
Ransomware Crisis Communication: The 72-Hour Plan for Management
This realistic playbook covers what management must communicate in the first 72 hours after a ransomware incident. It addresses GDPR notification, NIS-2 early warning, employees, customers, and media.
Multi-Domain Mail Security: One Gateway, Many Domains
A central mail security gateway protects multiple domains in parallel. Each domain gets individual policies and a separate quarantine. Mailcow provisioning is automated.
Law Firms, Tax Advisors, Audit Practices: Client Confidentiality, BORA/StBerG and Cyber Security 2026
German professional confidentiality holders are personally liable for breaches, including through cyber incidents. Learn which minimums BORA, StBerG, and WPO demand in 2026.
Automated Malware Analysis with the SecTepe Malware Sandbox
The SecTepe Malware Sandbox runs suspicious attachments in Windows and Linux guests, extracts indicators and watches malware from the outside.
LLM-Based Phishing Classification: BEC Detection With a Local LLM in the Mail Pipeline
A local LLM (Ollama) catches phishing and business-email-compromise messages that survive classical filters. It is GDPR-compliant and needs no cloud API.
CTI Integrated: MISP, YARA, a Knowledge Graph and a Self-Hosted Ransomware Intel Service
An integrated threat intelligence stack combines MISP, YARA, our own CTI knowledge graph and a self-hosted ransomware actor feed. It plugs directly into mail, sandbox, and SIEM pipelines.
GRC TCO and ROI: In-House Platform vs. Vanta/Drata Over 3 Years
An honest 3-year math for SaaS GRC versus an EU-native in-house platform. We compare license costs, internal effort, migration risk, and exit costs.
Cyber Risk Board Reporting: What Management Really Needs to Know
This is what effective cyber risk reporting to management and supervisory board looks like. It uses KPIs that drive decisions, not number walls that distract from them.
Digital Sovereignty: Why Self-Hosted Cyber Security Is a Strategy Again in 2026
Cloud Act, Schrems II, NIS-2, and the SaaS cost explosion are driving a shift in 2026. More and more mid-market businesses are pulling their security stacks back to the EU and in-house. Here is why.
SecTepe.Comm: The Sovereign Cyber Security Platform for Mid-Market Businesses
Learn what SecTepe.Comm is and which building blocks the platform integrates. We also explain why self-hosted cyber security increasingly pays off in regulated mid-market environments.
IVDB Integration for German Statutory Health Insurance: B3S-Compliant ISMS Without CSV Pain
Direct IVDB integration (CSV import plus a future API) dramatically speeds up a B3S-compliant ISMS build for German health insurers. Conflict detection and a progress display are included.
Asset Management With Lifecycle Tracking: The Foundation of Every ISMS
An ISMS without a clean asset inventory is worthless. Learn how SecTepe.Core integrates asset lifecycle, protection-need analysis, and ownership.
Review Cycle Management: Automated ISMS Reviews for Policies, Controls, and Assets
Automated review cycle management makes ISMS maintenance effort calculable. It uses frequency-based scheduling, multi-channel reminders, and escalation.
Risk Management in the ISMS: Assessment, Treatment, Residual Risk – Without Excel Hell
Integrated risk management brings risk assessment, treatment decision, and residual risk acceptance together in an auditable way. Human judgment stays where it is needed.
AI-Supported Compliance: Policy Generation, RAG Audit Assistant, and STRIDE Threat Modelling
Learn where AI really delivers value in compliance and ISMS workflows, and where it doesn't. We cover policy generation, a retrieval-augmented audit assistant, and STRIDE threat modelling.
Supplier & Vendor Portal: Structured Third-Party Risk Management
An integrated supplier portal drastically reduces supplier onboarding effort. It offers self-service questionnaires, evidence collection, and a risk score.
White-Label Trust Center: A Compliance Portal Under Your Own Domain
A white-label trust center under your own domain makes compliance evidence, status pages, and certificates public. It serves as proof of trust for customers, partners, and auditors.
Framework Change Management: Detect Standard Updates Automatically and Reassess
A GRC platform can proactively detect updates to ISO 27001, NIS-2, and BSI IT-Grundschutz. It analyzes the impact and coordinates reassessments. No more manual newsletter shifts.
eIDAS-Compliant Digital Signatures with PGP/GPG Integration
eIDAS-compliant digital signatures combined with PGP/GPG replace the classical print-sign-scan workflow. An audit trail and long-term validation are included.
ISO 27001 Certification in 6 Phases: The Structured Roadmap with a Wizard
ISO 27001 certification typically takes 18 months. A structured 6-phase roadmap with phase gating, templates, and a wizard turns it into a predictable process.
Audit Preparation in 4 Weeks Instead of 4 Months: The Management Playbook
ISO 27001 or NIS-2 audit preparation can take 4 weeks instead of 4 months. The key is ISMS data from one platform instead of Excel forests.
DORA + NIS-2 + ISO 27001: How a CISO Manages Three Mandates Without Burnout
Three regulatory mandates in parallel, one CISO with two hands. A multi-framework platform eliminates duplicate work and prevents CISO burnout.
Multi-Framework Compliance: ISO 27001, NIS-2, and BSI IT-Grundschutz From One Platform
An integrated GRC platform maintains multiple frameworks in parallel and computes cross-mappings automatically. This avoids duplicate work in assessments.
SecTepe.Core: The EU-Native GRC Platform for Compliance, Risk, and ISMS
Learn what SecTepe.Core is and which frameworks the platform covers. We explain why an EU-native GRC solution becomes the strategic answer to Vanta, Drata & co. in 2026.
Understanding the Importance of Cybersecurity Training
Regular employee training is the key to IT security. Learn how organizations can build an effective awareness program.
Benefits of an External Information Security Officer
For many organizations, an external ISO is the better choice. Learn the advantages of outsourcing this critical role.
Cyber Security: Effective Measures for Better Information Security
This overview covers the key measures organizations should implement to significantly improve their information security.
10 Common Penetration Testing Mistakes and How to Avoid Them
Avoid the most common pitfalls in planning and running penetration tests. Get the most security improvement out of them.
AI: Blessing or Curse for IT Security?
Artificial intelligence is transforming cybersecurity, for defenders and attackers alike. An analysis of opportunities and risks.
Phishing Threat in Microsoft Teams: Active Exploitation of a Vulnerability
Attackers are actively exploiting a critical vulnerability in Microsoft Teams for phishing. Learn how to protect your organization.
ISO 27001: The Guide to Information Security
Everything you need to know about ISO 27001 certification. From the basics to a successful ISMS implementation.
Penetration Test Reveals: How Secure Is Your WordPress Website Really?
WordPress powers over 40% of all websites. Learn which vulnerabilities penetration tests commonly find and how to protect yourself.
Social Engineering: The Psychological Dimension of Cyber Threats
Learn how attackers exploit human psychology and which strategies help organizations against social engineering attacks.
The Information Security Management System (ISMS)
An ISMS is the foundation of every successful information security strategy. Learn how to build and run one effectively.
Incident Response: A Deep Dive into the Heart of Cyber Security
This guide explains what happens when an incident occurs. It shows how to build and improve your incident response process.
ITundTECH Podcast: ISMS and Cybersecurity with Florian Bieselt
On the ITundTECH Podcast, Florian Bieselt talks about ISMS and the motives behind cyberattacks. He also shares practical paths to greater corporate security.
Deepfake Detection Made Easy: How to Spot Manipulations
The tongue is a surprising detection feature. Realistic tongue movements remain a real challenge for deepfake algorithms.
Cybersecurity Is a CEO Matter – The Insider
On the Nico Werner Podcast, David Eckel discusses a supposedly external hacker attack. It turned out to have an internal cause.
SOCaaS – SOC as a Service: Security Operations Center as a Service
SOCaaS gives organizations round-the-clock expert knowledge and modern technology for proactive cybersecurity monitoring. They do not need to run their own SOC.
IT Security Check: Guide to DIN SPEC 27076
The IT security check according to DIN SPEC 27076 offers a structured framework. It helps evaluate security measures and identify vulnerabilities.
An Overview of Cyber Security as a Service (CSaaS)
CSaaS is an outsourcing model for cybersecurity. It gives organizations access to expert knowledge and advanced technology for comprehensive protection.
Maximum Cybersecurity: Phishing Simulations and Red Team Tests
Phishing simulations and red team tests together form a solid cybersecurity strategy. They uncover both technical and human vulnerabilities.
Security Awareness: Protection in the Digital Age
Security awareness means understanding security risks in IT. It is a critical factor in protecting businesses from cyberattacks.
Community-Driven Cyber Security Awareness Training
SecTepe's community-driven awareness training keeps adapting to new threats. It provides a solid foundation for security culture.
A Recap of the Kiwiko Partner Meeting 2024 in Weimar
Two days of inspiring conversations, workshops on digital transformation, and intensive networking in the heart of Weimar.
Cybersecurity Training: Free on YouTube
SecTepe and Colossyan offer free ISMS and cybersecurity training on YouTube. It is available in German and English, ideal for beginners and advanced learners.
Pros and Cons of an External CISO: A Guide
External CISOs offer cost savings and objectivity. Internal CISOs bring deeper company knowledge and a long-term perspective.
Cybersecurity Consulting: A Partner in the Digital Era
Professional cybersecurity consulting protects your business. It strengthens digital resilience through risk management, compliance, and awareness.
AI and Big Data: Data Protection Strategies
Learn how AI and big data impact data protection. We show which strategies are decisive for IT security and privacy in the digital era.
AI-Generated Videos: The Future of Information Security
AI-generated videos are transforming information security. They bring more efficiency, personalization, and realistic training content.
DFIR: Digital Forensics and Incident Response
DFIR combines digital forensics and incident response. It is an indispensable part of modern cybersecurity strategies against cyberattacks.
Endpoint Detection and Response – SecTepe & CrowdStrike
EDR is an essential part of modern cybersecurity strategies. It detects threats in networked systems early and responds to them.
Recognition: Our Team in the BSI CVD Hall of Fame
Our team has been added to the Hall of Fame of the BSI's Coordinated Vulnerability Disclosure. It recognizes our commitment to cybersecurity.
7 Anti-Phishing Tips for Consumers
Protect yourself from phishing and ransomware with seven practical tips. They range from sender verification to two-factor authentication.
Responsible Disclosure: The BSI's CVD Guideline
The BSI's CVD guideline sets out a structured process for coordinated vulnerability disclosure. Through collaboration, it protects end users.
6 Steps for an Effective ISMS Awareness Program
A strong information security awareness program significantly improves organizational security. It relies on employee training and risk awareness.
Qakbot: The Largest Botnet Has Reached Its End!
FBI and Europol neutralized the Qakbot botnet in Operation Duck Hunt. They freed 700,000 computers and prevented $58 million in damages.
Cyber Security in Germany 2023: A Look into the Digital Future
Germany is battling rising cybercrime, with damages of over 200 billion euros a year. Protective measures are essential.
Welcome to the SecTepe Blog
Welcome to the SecTepe Blog for cyber security, information security, and forensics. Here you get practical tips and expert insights.
Do You Have Questions About Cybersecurity?
Just ask us. Our experts are glad to help with all things information security and IT security.
Get in touch