Perimeter & network
Firewall, segmentation, IDS/IPS and secure remote connection of your sites
OPNsense / NetBirdIT Security // SEC / 2026
Security
in depth.
IT security is built from several levels of protection, from the firewall at the edge of your network to the awareness of your staff. We work with clear measures, documented tests and a plan for emergencies.
01 / 04
Six Lines of defence
Endpoint Security
Managed antivirus, application control and disk encryption on every device
Defender / BitLockerIdentity & Access
Single sign-on, multi-factor authentication and a strict least-privilege model
Zitadel SSOMail Security
Multi-stage filtering against phishing, spam, malware and business email compromise
Mailcow ASSPBackup & Recovery
Encrypted, monitored backups as the last line of defence against ransomware, optionally also in a second data centre
Proxmox PBS / BaculaAwareness & Training
Regular training, phishing simulations and a documented training history
Lucy / Sosafe→ No single measure is certain to stop a determined attacker. Six lines of defence in a row make it much harder. That is defence in depth.
02 / 04
What we deliver
SEC-01
Firewall Management
Configuration, patching and monitoring of your OPNsense firewalls. Clean rule sets, documented, versioned and reviewed.
SEC-02
Managed Antivirus
Centrally managed protection for your devices. We monitor in real time and report suspicious activity automatically.
SEC-03
Backup & Disaster Recovery
Managed Backup via Proxmox Backup Server or Bacula in data centres in Germany. Backup in a second data centre and documented restore tests as options, emergency plan charged by effort.
SEC-04
Mail Security
Protection against phishing, spam and malware through multi-stage filtering, DKIM/SPF/DMARC and continuous reputation checks.
SEC-05
Vulnerability management
Periodic scans of your infrastructure, prioritised by CVSS and contextual risk assessment. Fixes go through our change management.
SEC-06
Security Awareness
We provide quarterly training, phishing simulations and individual reports.
Compliance
We follow the German BSI baseline protection and support you in implementing TOMs under Art. 32 GDPR. On request we accompany audits, ISO 27001 preparations and cyber insurance applications.
03 / 04
From assessment to ongoing support
01
Assessment
We analyse your security status against the BSI IT-Grundschutz modules and identify the critical gaps.
02
Measures
A prioritised roadmap with quick improvements and medium-term measures. For each step we state the effort and the benefit.
03
Implementation
We put the measures in place, from firewall rules to setting up Conditional Access.
04
Ongoing support
Security needs ongoing care. We look after the set-up continuously, train your team and review the risks every quarter.
FAQ
Frequent questions
Q.01 Will your measures make us GDPR-compliant?
We implement technical and organisational measures (TOMs) under Art. 32 GDPR and document them. Full GDPR compliance also covers organisational aspects (record of processing activities, contracts, training), where we support you. Formally, you remain responsible as the controller.
Q.02 What does an initial security assessment look like?
We start with a structured workshop (2–3 hours) and review infrastructure, identities, backups and processes. You receive a written report with prioritised recommendations, effort estimates and concrete immediate measures.
Q.03 What happens in an emergency, such as a ransomware attack?
We follow a fixed procedure: isolate affected systems, preserve evidence, restore from your backups, coordinate with authorities and your insurer, follow up. An in-depth forensic analysis is charged by effort. The response time depends on your maintenance contract; 24/7 on-call is available on request and agreed separately.
Q.04 How are you different from an antivirus vendor?
A single product is not a security strategy. We work in several lines of defence, integrate the components through our service desk and also look after the people, because many attacks start with a phishing email.
Q.05 Can you train my staff?
Yes. We offer awareness training, phishing simulations and individual refreshers, on site, online or both, matched to your industry and risk profile.
KAT
SecurityBuilding blocks
NDS-ID-ZITADEL
Zitadel identity provider
One account for all your applications. We run Zitadel as an identity provider ourselves, based on the OIDC standard and with MFA mandatory from the start.
Fully sovereign
NDS-SEC-BCK-ACR-SRV
Acronis Backup Server
We back up your physical and virtual servers with Acronis Cyber Protect. Each backup captures the whole server as an image, handles running applications consistently and is held in cloud storage in Germany.
Hybrid
NDS-SEC-BCK-ACR-WS
Acronis Backup Workstation
We back up notebooks and desktop PCs with Acronis Cyber Protect. Each backup is an image of the whole device (block-level image), stored in a data centre in Germany. You can restore single files or the entire device.
Hybrid
NDS-SEC-COMPLIANCE
Compliance monitoring
We check your IT against GDPR and ISO standards on an ongoing basis. The technical controls run automatically, and you receive a report every quarter.
Fully sovereign
NDS-SEC-AV
Managed Antivirus
We manage the antivirus protection on your workstations and servers centrally. As standard we use Microsoft Defender Antivirus (built into Windows), controlled through our RMM; a third-party product is also possible. Alerts go to the service desk, and you receive a report on protection coverage weekly (recommended) or at an interval of your choice.
Fully sovereign
NDS-SEC-FW
Managed Firewall OPNsense
A firewall for your site based on OPNsense. This open-source solution offers the features of large commercial products, and Netsource looks after it and installs the updates.
Fully sovereign
NDS-ID-MFA
MFA rollout and maintenance
Every member of staff signs in with a second factor (multi-factor authentication, MFA) using a TOTP app, a FIDO2 security key or a passkey. Zitadel enforces this centrally.
Fully sovereign
NDS-DEF-EP
Microsoft Defender for Business
Detection of and response to attacks on workstations and servers (endpoint detection and response). We enable the standard policies, and the Netsource service desk reviews the alerts.
Hyperscaler
NDS-SEC-PATCH
Patch and update management
We install updates on workstations and servers in an orderly way: first in a test group, then on all devices, without restarts at awkward moments. Each month you receive a report on the current status.
Fully sovereign
NDS-SEC-WAZUH
Wazuh SIEM Managed
We collect and assess security events from your devices, servers and cloud services in one place. We run the platform and read the alerts, and critical incidents reach you as tickets.
Fully sovereign
How secure is your IT really?
In a two-hour assessment we find the critical gaps before an attacker does. You receive the findings in writing.