Requirement clarification
What exactly does the risk, finding or regulation require — and what is the minimum effective measure?
Cybersecurity & compliance
From identified gap to the right security measure
An ISMS, audit or risk assessment tells you what is missing. It rarely tells you what to do next. We help you find the most appropriate response — which is not always a new product.
Why consulting should not stop at documentation
- The risk treatment plan says “implement logging” — but how, with what, and who operates it?
- Vendors each claim to solve everything
- Existing tools already have the capability, but nobody knows
- Open-source options are dismissed or adopted without a plan for operation
- Purchases are made without checking whether they address the actual risk
What we help with
Existing stack review
Which capabilities do your current systems already offer, licensed but unused?
Process options
Where an organizational or process measure is sufficient or better.
Open-source options
Credible open-source tools — including what it takes to operate them.
Vendor shortlists
Relevant vendors from our curated database, with a strong European focus.
Decision support
Comparing options by risk reduction, effort, cost, operation and dependencies.
How we find the right measure
-
Requirement
Start from the risk, finding or regulatory requirement.
-
Existing stack
Check what your current technology can already do.
-
Organizational measure
Consider whether a process or organizational change is sufficient.
-
Open source & EU vendors
Research open-source and European options where appropriate.
-
Decision & implementation
Choose, plan the implementation and document it in the ISMS.
Not “find another product to buy”
Our goal is the most appropriate measure for the identified requirement. Sometimes that is a new tool. Often it is a setting, a process or a capability you already pay for. We have no reseller model that would bias our recommendation.
The right measure
Five questions before anything is bought
We work through these questions in order. Often the answer is found at question one or two.
-
Can your existing technology solve the problem?
-
Is an organizational or process measure sufficient?
-
Is an open-source solution appropriate?
-
Is a European cybersecurity provider appropriate?
-
Is another commercial product necessary?
What you get out of it
- Measures that address the actual risk
- Better use of the technology you already have
- Transparent decisions that hold up in the next audit
Frequently asked questions
Do you sell security products?
No. We advise on measures and help you evaluate options. That keeps our recommendations independent from product margins.
Do you only recommend European vendors?
No. We give European and open-source options serious consideration because technology independence matters. But the best measure for the requirement comes first — and European does not automatically mean more secure.
Related services
Related services
Cybersecurity Vendor Advisory
Requirement-driven vendor selection with curated intelligence on 350+ cybersecurity vendors and a strong European and open-source focus.
ISMS & ISO 27001
Build a working ISMS and prepare for ISO/IEC 27001 certification — together with your team and on top of the tools you already use.
Funding Advisory
Identify relevant funding programs for cybersecurity, digitalization and AI projects in Germany, the federal states and the EU.
Related in the FeldmannCyber App: Vendor Intelligence
Related reading
Can an ISO 27001 ISMS use your existing tools?
Can an ISO 27001 ISMS use your existing tools? Yes — how wikis, document management, ticketing and project tools can carry large parts of it.
Funding in Hesse: how to scope digital and cybersecurity projects correctly
Funding for digital and cybersecurity projects in Hesse: Distr@l, RKW consulting grants, DIGI grant, push!, Prototype Fund and the de minimis rule.
Recap: IT Managers Meeting at IHK Darmstadt — security monitoring along the Cyber Kill Chain
Recap of the IHK Darmstadt IT managers meeting: FeldmannCyber on IT security monitoring along the Cyber Kill Chain — scans, monitoring and SIEM.
Have a finding and no clear next step?
Tell us what the requirement is. We help you find the measure that fits.