Mandates where it held.

We first examined the environment from an attacker's perspective and derived scenarios for how targeted attackers actually operate in aviation. On that basis, we accompanied the move to a new endpoint and server detection platform, wrote the test cases, automated the checks and connected everything to central security monitoring. Detection was not assumed. It was tested against real attack techniques.

We are responsible for the security architecture of a platform that processes classified information. In addition, we carried out penetration tests for the public sector. We are not permitted to say more about this, and that is exactly how it should be.

In three consecutive engagements we rebuilt the group's security. First a multi-tenant security architecture for the data center, implemented as code and connected to security monitoring. Then the tender and technical evaluation of cloud security platforms for worldwide communication. Finally, replacing classic perimeter security with protection at the application layer, designed against the requirements for critical infrastructure. The decision papers for the board came from us.

An energy group wanted to move its security architecture from classic perimeter concepts to a hybrid cloud. We designed the move and checked every decision against the regulatory requirements for critical infrastructure, rather than having to justify it afterward. The rebuild covered the whole group, not one site.

Classic signatures see little in industrial protocols. We designed the security architecture for OT and developed a learning method that recognizes communication relationships in the control system by behavior and reports deviations. That included naming the cases production monitoring should actually detect, and taking automatic detection of unauthorized access from prototype into live operation, under the availability requirements of process IT.

A legacy application that had grown over the years was exchanging data from process IT. We analyzed its protocol by reverse engineering and built a cryptographically secured relay service that connects the control system to cloud storage, with its own authentication between the two worlds, encryption at rest and in transit, and running as a high-availability cluster.

The group uses three hyperscalers, one of them in China. We designed cloud security across all three, so that each platform does not bring its own level of protection, and made the differences visible where they cannot be resolved. Anyone working in several clouds needs one standard that applies to all of them.

Firewall rule sets that have grown over years can hardly be assessed by hand: nobody knows which rule is still needed and which one merely survived. We evaluated the rule sets by machine, separated the relationships actually in use from the dead ones, and planned a migration on that basis that needs no downtime. What we now call AI-first grew out of this way of working.

For a factoring provider and another financial services firm we tested platforms and applications by penetration test and measured them against the sector's security standards. At a financial institution, the migration of the security components followed; operations have run automatically since, across heterogeneous platforms.

We tested SD-WAN solutions from three vendors against each other in proof-of-concepts, set the evaluation criteria beforehand and assessed the security functions against the SASE standard. The decision paper for the leadership came from us, including why the weaker solutions were weaker.