Who is behind Threat‑Informed®
For us, security is not a service but a responsibility. We are a cybersecurity team from Germany, and our consulting is threat-led: with our own tools and the experience of 15 years of responsibility and auditing.
From Incident to Mission
The Wake-Up Call
A serious security incident, managed under personal accountability as Deputy Group ISO and Head of Cybersecurity. The realization: despite heavy investment, no effective protection. The search for a better approach begins: Threat-Informed Defense.
The Founding
Threat-Informed Cybersecurity Solutions GmbH is founded with one mission: to work threat-informed and give CISOs real steering instruments instead of producing paper.
The Proof
TOP 10 CISO Award for introducing Threat-Informed Defense at a former employer. In parallel: admission to the ATHENE SpeedUp Secure Accelerator and the launch of CertMap.
The Confirmation
CISO of the Year, 1st prize, for Threat‑Informed. The approach from practice is now the foundation of our consulting.
What you can hold us to
Daniel Thomas Heessel
Verifiable Expertise
At our company, expertise is a team effort: our team’s certifications cover the entire field, from management, risk and audit through offensive security and detection to cloud and data protection.
What we stand up for
Security knowledge does not belong behind paywalls
We publish our methodology in trade media, provide tools such as the Quick Check and CertMap free of charge and share what we learn, because shared knowledge protects better.
Small where it doesn’t need to be big
Remote-first, paperless, digital processes from proposal to report. Where travel is necessary, we bundle appointments: the footprint of consulting should be as lean as its reports.
Security for those who have no CISO
Cybercrime hits hardest those who cannot afford a security department. We support non-profit organizations with discounted consulting and awareness work.
What we publish
Threat-Informed Defense in a Nutshell
Lead article (German): why security programs have to start with the adversaries, and how Threat-Informed Defense works in practice.
Ansehen →SOC Is a Business Model, Not a Legal Mandate
Article (German): NIS2, DORA and CRA require detection & response as a capability, not necessarily a dedicated SOC. On choosing the right operating model.
Ansehen →Claude Mythos and the End of the Cost Barrier for Cyberattacks
Article (German): how AI drastically lowers the cost of finding vulnerabilities, and what that means for the defensive logic of cybersecurity.
Ansehen →Berlin Hack 2026: Ransomware, Data Exfiltration and a Critical Infrastructure Gap
Article (German): how Rhysida took 5.79 terabytes from the State of Berlin’s network. Not through sophisticated technique, but through missing attack detection, plaintext passwords and an administration that had exempted itself from the detection obligation.
Ansehen →