What really protects my IT?
IT security.
No single product makes you secure. Only the interplay of technology, processes and people does.
In 60 seconds
- Security is built in 6 layers, not by a single product.
- 3 tasks: prevent, detect, respond.
- The five most important basics: password manager, MFA, updates, backup, phishing reporting channel.
3 tasks, one goal.#
Good security prevents, detects and responds.
Prevent
Attacks should not succeed in the first place.
- Install updates and patches promptly
- MFA and minimal permissions
- Hardening and network segmentation
Detect
Whatever slips through must be noticed, and quickly.
Respond and recover
When it happens, the plan and practice count.
- Emergency plan with clear roles
- Incident response and forensics
- Test backups regularly
Protection in 6 layers.#
Choose a layer on the right. The matching ring lights up.
1. People and processes
Many attacks start with people, for example through phishing. Training, clear reporting channels, roles and a practised emergency plan noticeably reduce the risk.
Typical building blocks: awareness training, phishing simulations, policies, an information security management system (ISMS).
2. Identities and access
Who are you, and what are you allowed to do? MFA, single sign-on and the principle of minimal permissions (least privilege) protect accounts. Particularly powerful accounts are additionally secured with privileged access management (PAM).
3. Network
The old moat model, where everything inside is trusted, is no longer enough. Segmentation, firewalls and Zero Trust access limit where an attacker can move.
For branch offices and home working, concepts such as SASE or SSE are used.
4. Endpoints and servers
Computers, smartphones and servers are the target of many attacks. Regular patching, hardening and EDR/XDR detect suspicious behaviour and allow quick isolation.
5. Applications and cloud
Misconfigurations are a common cause of incidents. Vulnerability management, secure development (DevSecOps) and cloud security tools keep applications and cloud environments under control.
6. Data and backup
In the end it is about the data. Encryption, access control and classification protect it. Backups following the 3-2-1 rule with tested recovery are the best insurance against ransomware.
Threat glossary.#
The most important types of attack in one sentence, with the best protection against them.
Malware
Protection: Antivirus with behavioural analysis (EDR), updates, no admin rights in everyday use.
Go to termRansomware
Protection: Separate, immutable backups and a practised emergency plan.
Go to termPhishing
Protection: Check sender and link, MFA, if in doubt ask via a known channel.
Go to termSocial Engineering
Protection: Confirm via a second channel, four-eyes principle for payments.
Go to termZero-Day
Protection: Segmentation, monitoring and fast patching as soon as an update is available.
Go to termDDoS
Protection: Protection service from your provider or in the cloud, agree emergency contacts in advance.
Go to termBotnet
Protection: Change default passwords, put IoT devices in a separate network, updates.
Go to termSupply chain attack
Protection: Vet service providers, limit access, roll out updates in a controlled way.
Go to termCredential Stuffing
Protection: A separate password and MFA for every account.
Go to termMan-in-the-Middle
Protection: Encrypted connections, take certificate warnings seriously, VPN on public Wi-Fi.
Go to termPrompt Injection
Protection: AI agents only with minimal permissions, approval before every action.
Go to termDeepfake
Protection: Agree on a code word and call back on a known number.
Go to termFrom overview to operation.#
This is how professional projects typically proceed: plan, build, operate.
Inventory
Which systems, data and risks are there? An assessment shows the gaps.
Concept
Architecture, priorities and alignment with requirements such as NIS2 or ISO 27001.
Implementation
Introduce technology, reorganise accounts and networks, involve employees.
Operation
Patching, monitoring, handling incidents, often with a SOC or MDR service.
Review and improve
Penetration tests, audits and emergency exercises show what really holds.
What IT service providers cover today.#
A neutral overview of typical portfolios.
Governance, risk and compliance
Information security management, data protection and implementation of NIS2, DORA, the Cyber Resilience Act or the AI Act.
Architecture and technology
Zero Trust, SASE, identities, endpoint, email, network and cloud security.
Offensive Security
Penetration tests, red and purple team exercises, Active Directory assessments.
Detection and response
SOC, SIEM, MDR/XDR, threat intelligence, vulnerability and dark web monitoring.
Incident response and resilience
Forensics, recovery, emergency exercises and cyber resilience concepts.
OT and IoT security
Securing facilities, buildings and connected devices, sometimes with a dedicated IT/OT SOC.
What stands out.
| Trend | What is behind it |
|---|---|
| Monitoring as a service | Round-the-clock monitoring is hard to provide internally. Many providers therefore offer SOC and MDR as a service, often from data centres and teams in Germany. |
| Regulation as a driver | NIS2, DORA and other requirements increase the pressure to run security in a demonstrable and documented way. |
| Zero Trust instead of a moat | Instead of protecting the perimeter, every access is checked. Identities and segmentation move to the centre. |
| Everything from one source | Consulting, implementation and operation are offered as a chain, from analysis to incident response. |
| IT and OT are converging | Production and building technology is connected to the network. Shared monitoring models are emerging for this. |
Source: publicly available portfolio descriptions of Bechtle, CANCOM, Computacenter, Controlware, SVA, Datagroup, T-Systems and Axians, summarised independently and vendor-neutrally. As of November 2026.
Frequently asked questions.#
What is the difference between EDR, XDR and MDR?
EDR monitors individual endpoints, XDR also covers email, network and cloud. MDR is the service behind it: a team analyses the alerts and helps with the response.
Does a small business need a SOC?
Usually not its own. If nobody can watch around the clock, an MDR or SOC service is an option. The basics come first: MFA, updates, backups and an emergency plan.
Does NIS2 affect me?
That depends on your industry and company size. Have it checked specifically, for example with an assessment or through your trade association. The measures it contains are good practice anyway.
Where do I start?
With these five: password manager, MFA, automatic updates, tested backup, a reporting channel for phishing. The basic check helps with the order.
Questions? Get in touch.
Write to me if a topic is missing or you want to know more.