We build software that lets companies receive vulnerability reports, recognise risks in their supply chains and find the right security partners. Effective security should be within reach of companies of every size.
SovereignOur own servers in Germany. No access under the US CLOUD Act.
ConfidentialNo use of data without a formal agreement.
OpenOpen standards and transparent procedures.
Vision
Whereknowledgeflowstogether.
Cybersecurity is full of questions that still have no good answer. Those are the ones we choose. We are working towards a network in which knowledge about vulnerabilities, supply chains and code comes together instead of staying scattered, and from which every company benefits.
Combine
Many sources, one strand.
Anticipate
Spot failures before they spread.
Share
Security grows when you share it.
Products
Fivetools,onesystem.
Built for small and medium-sized companies: security at the level of the large ones, without needing a department of your own for it. Choose a tool to see what it does for you.
Open source · Internet-Draft
CVD Policy
Rules that programs can read too.
An IETF draft by two of our founders: rules for security testing, published in a form that machines can read as well. Create and validate a policy for free in the browser.
What you gain
A disclosure policy of your own in minutes, free in the browser.
Whoever finds a flaw knows at once how to report it to you.
Reported by web form or e-mail, attachments held in quarantine, matched against known vulnerabilities, then reviewed by an analyst. The company maintains its security.txt and policy itself, under its own domain.
What you gain
A reporting channel like the large companies have, without a team of your own for it.
Reports arrive checked and in order instead of getting lost in an inbox.
Your security.txt and policy stay under your own domain.
The supply chain as a directed graph, down to the individual material and the production line. A temporal graph neural network learns how failures spread from past events instead of assuming it.
What you gain
See which suppliers put your production at risk before it gets serious.
Early warning instead of firefighting when a link in the chain fails.
The same policy checks code in the editor, in the pipeline and in the repository. For AI agents, a rule per path decides what actually reaches them: the agent keeps working, but the content never enters its context.
What you gain
Security checks that run in the background while your team develops.
Flaws show up before they reach production.
AI assistants only get to see what they are allowed to see.
Nearly twenty years in IT security: an EDR vendor, projects for DAX-listed corporations, incident management at a bank, most recently managing director of a security provider.