Consulting
Security & AI Consulting
Technical consulting for organisations that must prove their IT security and want to use AI without giving up control - from more than 20 years of practice with public authorities, critical-infrastructure operators and large enterprises, and from our own products.
Consulting from a vendor - what that means for you
We advise with what we build and operate ourselves. Every recommendation has a test bench with us: our own products, our own IT, the projects of the last twenty years. That makes a difference you will see in the result.
-
Measure instead of guess
Consulting starts with the actual state, not with assumptions: SecCheck reads your Windows systems against BSI IT-Grundschutz, CIS Benchmarks and Microsoft Security Baselines. We deliver the interpretation, the priority and the action plan - and in the end the report your auditor can verify. -
Hardening that holds in operation
With omniDEPLOY we built hardening as versioned layers: CIS Level 2, BSI, Microsoft baseline, plus every operational relaxation justified and measured individually. We know which setting paralyses a workstation and which one only looks good in the checklist. -
Windows down to the detail
Services without back doors, UAC elevation, code signing and Authenticode, signed update chains with rollback, Secure Boot chains, Intune, MECM and Group Policy - knowledge from our own tools Win-INNsider and File-INNsider, not from a data sheet. -
AI from our own house
AI assistants in development, documentation and sales, an AI-supported CRM, AI analysis in SecCheck - EU-hosted, with pseudonymised data, with clear responsibilities. We know where AI carries its weight, where it is only a demo, and how to introduce it so that data protection and traceability do not fall by the wayside.
Consulting areas
Security and hardening
Hardening and auditing to BSI IT-Grundschutz, CIS Benchmarks and Microsoft Security Baselines; Active Directory tiering, privileged access, modern authentication. Baseline assessment with SecCheck, action plan by risk and effort, support during implementation, evidence for the audit.
Regulated environments
KRITIS, NIS2, DORA, TISAX and the defence sector: building and securing IT landscapes with evidence obligations - isolated networks, controlled supply chains, operation without cloud, proof per system. From target picture to acceptance, developed from real projects.
Enterprise architecture
Target pictures, blueprints and cloud roadmaps; tenant design and governance; client architectures up to six-digit endpoint counts; deployment without Intune and domain where needed. Decisions as a template with options, pros and cons and a recommendation - so your management can decide, not just nod.
AI integration
Bringing AI securely into existing processes: finding use cases with real benefit, data protection from the start (pseudonymisation, EU hosting, GDPR), defining guardrails and responsibilities, evaluating tools, building documentation that people and AI assistants can work with. No AI at any price - but where it takes work off your hands, done properly.
How we work
- Assessment, measurable. System states, architecture, processes - collected with tools, not by questionnaire. What we cannot measure we call an assumption and mark it as such.
- Decision template. Options with pros and cons, effort and risk, a recommendation and a status - in a form a board member reads and an administrator can implement. We document architecture decisions with context, decision and consequence.
- Supporting implementation. Review before anything touches production hardware; small, verifiable steps; deviations are justified, not hidden.
- Evidence. Acceptance protocol, target/actual comparison, documentation with honest delineation: implemented, partial, open. That is what an auditor wants to see - and what your successor needs.
The result is not slides but working documents: action plans, decision templates, hardening profiles, operations manuals - and documentation that an AI can read too and that your team can keep working with.
Typical triggers
- "NIS2 or DORA require evidence - we have policies, but no numbers."
- "The audit findings are on the table, and nobody knows which of them are really critical."
- "Our Active Directory grew, it was not planned - tiering and privileged access must become clean."
- "We need an isolated environment with devices that must never reach the internet - from target picture to acceptance."
- "The cloud tenant is to be redesigned: governance, identities, client architecture for tens of thousands of endpoints."
- "We are supposed to introduce AI - GDPR-compliant, with clear responsibilities, without business units going it alone."
- "Our industrial and kiosk devices run without Intune and domain - how do we roll them out verifiably?"
What we deliberately do not offer
No general IT consulting, no project-independent body leasing, no permanently outsourced operational services. We work per project, clearly scoped and with a result that stays with you in the end - in operation and in documentation.
How we use AI within our own company is described on the company page.
Let's talk about your question
A first conversation clarifies whether we are the right ones - and what the first measurable step would be. Use the contact form or give us a call.
Or directly: +49 851 204248-0 · info@bitstream.de