What doIT solutions does

doIT solutions GmbH is a Germany-based managed cybersecurity services provider founded in 2010 by Dominik Oestreicher and headquartered in Gelnhausen. The company operates a modular Security Operations Center (SOC) portfolio anchored by its flagship product, SOC-in-a-Box, which combines hardware, software, and managed services into a single fixed-price subscription package — described as the only all-in-one managed SOC covering SIEM (Security Information & Event Management), EDR (Endpoint Detection & Response), and NDR (Network Detection & Response) simultaneously. The underlying platform is built on what doIT calls the "SOC Visibility Triad," integrating leading third-party technologies from partners such as Splunk, Palo Alto Cortex, Darktrace, Elastic, Tenable, and Axonius to deliver 24/7 threat detection, incident response, vulnerability management, and compliance reporting. Add-on modules extend the core offering to include SOAR (Security Orchestration, Automation and Response), Threat Intelligence, Malware Analysis, Security Asset Management, Cloud Security (SaaS security posture management), and Security Validation (automated attack simulation).

The company's customer base spans mid-market to large enterprises in the DACH region, with a particular focus on KRITIS-regulated critical infrastructure operators and NIS2-regulated entities needing compliance with the System zur Angriffserkennung (SzA) mandate. Named customers include logistics (DACHSER), energy and building technology (CKW AG), energy network operation (N-ERGIE Netz GmbH — a 10+ year managed Splunk customer), and software consulting (CPA Softwareconsult GmbH). User counts range from approximately 300 to over 100,000 per customer. Revenue is generated primarily through recurring managed service subscriptions (SOC-in-a-Box, SOC as a Service) billed on log volume, endpoint count, and Gbit/s capacity, supplemented by professional services in consulting and Xpert Service (operational support). Distribution is exclusively direct enterprise sales via consultative initial consultations targeting CISOs, IT security managers, and SOC leads — no reseller or channel intermediaries are used. In September 2025, French cybersecurity services group I-TRACING (backed by Eurazeo, Sagard NewGen, and Oakley Capital) acquired a majority stake, with founder Dominik Oestreicher retained as Managing Director of the German branch. The company holds ISO/IEC 27001:2022, ISO/IEC 27017:2021, and ISO 9001:2015 certifications, and has held the highest Splunk Professional Service Partner status since 2021.

Name

doIT solutions

Legal name

doIT solutions GmbH

Website

https://doit-solutions.de

Company type

Private

Founded year

2010

Operating status

Operating

Headcount range

11–50 employees

Short description

doIT solutions GmbH is a German managed cybersecurity services provider offering modular SOC-as-a-Service (SOC-in-a-Box) combining SIEM, EDR, and NDR for mid-market and enterprise customers in the DACH region, particularly KRITIS and NIS2-regulated operators, and is majority-owned by French cybersecurity group I-TRACING since September 2025.

Ownership category

akta.pro rank

Product category

Managed Security Services

NAICS

Computer Facilities Management Services (541513), Computer Systems Design and Related Services (54151), Other Computer Related Services (541519)

SIC

Services-Computer Programming, Data Processing, Etc. (7370), Services-Computer Integrated Systems Design (7373)

akta.pro primary industry

Managed Security Services (MSSP) & 24/7 SOC Operations (BPAKAHAA)

akta.pro secondary industries

Security Operations Center (SOC) as a Service (BPAEADAB), Managed Detection & Response (MDR) & SOC Services (HDADAGAG), Endpoint Security Managed Services (EDR/XDR) (BPAEADAH)

Keywords

• Managed security services
• Security operations center
• Threat detection response
• Cybersecurity consulting
• SIEM solutions

Headquarters

HQ city

Gelnhausen

HQ country

Germany

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales

Revenue model

1. SOC-in-a-Box (Managed SOC): Modular managed Security Operations Center combining hardware, software, and managed service. Sold as a subscription with tiered service levels (Foundation, Enterprise). Scalable by log volume and endpoint count. Fixed-price model with optional add-on modules.
2. SOC as a Service (CSaaS): Cybersecurity-as-a-Service offering with 24/7 incident response, continuous monitoring, and regular security workshops. Billed based on log volume with data retention of at least 365 days. Supports customer-owned tools (BYO).
3. Consulting Services: IT security consulting including SOC concept development, budget planning, security monitoring analysis, and implementation support. Provided by experienced IT security experts.
4. Xpert Service: Operational support services including application management, system configuration updates, health monitoring, ticket processing, and IT change management for security monitoring solutions.

Pricing tiers

Go-to-market motion1 record

Distribution channels1 record

Marketing channels5 records

Core offering

doIT solutions provides a modular managed Security Operations Center (SOC) offering anchored by SOC-in-a-Box, which combines hardware, software, and managed service into a single fixed-price package covering SIEM, EDR, and NDR. The company delivers Cybersecurity-as-a-Service (CSaaS) including 24/7 incident response, alert engineering, continuous security workshops, and add-on modules such as SOAR, Threat Intelligence, Vulnerability Management, and Cloud Security. Complementary offerings include SOC as a Service, Cyber Intelligence Service, Xpert Service for operational support, and IT security consulting.

Product overview

doIT solutions offers a modular Security Operations Center portfolio anchored by SOC-in-a-Box, the company's flagship managed SOC solution combining hardware, software, and service as the world's only all-in-one SOC for SIEM, EDR, and NDR. The core SOC Visibility Triad platform provides endpoint (EDR/NGAV), network (NDR), and security event monitoring (SIEM/UEBA) capabilities. Add-on modules extend functionality including SOAR for orchestration and automation, Threat Intelligence, Malware Analysis, Security Asset Management, Cloud Security, Vulnerability Management, and Security Validation. The portfolio is complemented by managed services (Cyber Intelligence Service), technical support (Xpert Service), and consulting services. All offerings are delivered from Germany with ISO certifications and support both on-premise and cloud deployments.

Differentiator

Problem solved

Functional benefit

Products and services

• SOC-in-a-Box All-in-one managed Security Operations Center combining hardware, software, and service into a single fixed-price package. Provides SIEM, EDR, and NDR capabilities with 24/7 incident response, alert engineering, and continuous security workshops. Available as on-premise deployment or cloud instance and optimized for KRITIS/NIS2 compliance.
• Cyber Intelligence Service Managed SOC service providing proactive security monitoring that bridges the gap between operational IT, IT security, and risk management using a Detect, Respond, Improve approach for continuous improvement of incident response processes.
• Xpert Service Operational support service covering application management, system configuration updates, health monitoring, ticket processing, IT change management, and proactive configuration changes for security monitoring solutions.
• IT Security Consulting IT security consulting service combining expert knowledge with implementation experience, covering SOC concept development, security monitoring analysis, budget planning, and decision templates with cost-benefit analysis for prospective and current customers.
• SOC as a Service Cybersecurity-as-a-Service offering with 24/7 incident response, continuous monitoring, regular security workshops, and alert engineering. Billed based on log volume with data retention of at least 365 days, and supports customer-owned tools (BYO).

Named customers4 records

Segments3 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration14 records

AI capability13 records

Feature4 records

Partnerships

Twelve partnerships are on record, tiered core.

• Palo Alto Networks (Cortex XDR, Cortex XSOAR)coreTechnology or IntegrationPrimary technology partner for endpoint detection (Cortex XDR/XDR) and Security Orchestration, Automation and Response (Cortex XSOAR). doIT relies on Palo Alto's Cortex platform for EDR capabilities and SOAR functionality, citing best-of-breed technology, comprehensive MITRE ATT&CK coverage, and platform strategy as reasons for the partnership.
• Splunk (Enterprise Security)coreTechnology or IntegrationPrimary SIEM platform partner. doIT has held the highest Splunk Professional Service Partner status and has over a decade of experience with Splunk implementations. Splunk Enterprise Security is used as the central hub for comprehensive security monitoring and analysis.
• Darktrace (NDR)coreTechnology or IntegrationPrimary NDR (Network Detection and Response) technology partner. Darktrace is used for network traffic monitoring with machine learning and AI-based anomaly detection. Chosen for extensive detections, detailed information access, and automated filtering options.
• Elastic (SIEM, EDR)coreTechnology or IntegrationTechnology partner for SIEM and EDR (Elastic Defend). Elastic provides cost-effective expansion options for existing or new SIEM installations. Open-source variant enables inexpensive entry into log data processing.
• Tenable (Vulnerability Management)coreTechnology or IntegrationVulnerability Management partner. Tenable's VM solution monitors and manages patch and vulnerability status of infrastructure in real time. Supports both agent-based and network-based device access with fast and reliable attack vector detection.
• Axonius (Security Asset Management)coreTechnology or IntegrationSecurity Asset Management partner. Axonius provides comprehensive IT asset and identity inventory by integrating and consolidating data from a variety of sources and security tools. Reduces integration effort through an extensive pre-built framework and automates asset data collection and vulnerability detection.
• AppOmni (Cloud Security)coreTechnology or IntegrationCloud Security partner specialized in SaaS security. AppOmni monitors SaaS configurations and protects against unauthorized data access. Supports over 100 SaaS applications including Salesforce, Microsoft Office 365, Google Workspace, Slack, Dropbox, GitHub, and Zoom.
• Pentera (Security Validation)coreTechnology or IntegrationSecurity Validation partner. Pentera's tool continuously and automatically tests security measures using actual exploits and attack scenarios including ransomware and zero-day exploits. More comprehensive than traditional security testing.
• Cribl (Data Routing)coreTechnology or IntegrationData routing and transformation partner using Cribl Stream. Serves as a central data router for hybrid and cloud-native environments, enabling complex data processing requirements to be mapped effectively with exceptional scalability and flexible routing options.
• VM Ray (Malware Analysis)coreTechnology or IntegrationMalware Analysis partner. VM Ray provides advanced behavior analysis, sandboxing, and reverse engineering techniques to effectively identify and combat highly sophisticated malware. Enables real-time threat detection and immediate countermeasures.
• Pulsedive (Threat Intelligence)coreTechnology or IntegrationThreat Intelligence partner providing comprehensive and up-to-date threat understanding. Pulsedive collects threat data from various sources including IP addresses, domains, URLs, and hash values indicating malicious activity, enabling proactive defense measures.
• Maltiverse (Threat Intelligence)coreTechnology or IntegrationThreat Intelligence partner providing real-time threat data analysis and detailed contextualization. Supports automation of security processes through seamless integration into doIT's security solutions.

Scale indicators4 records

Recent moves5 records

Expansion highlights5 records

Direct peers

• Proficio: Proficio is a managed security services provider delivering MDR, SIEM-as-a-service, and 24/7 SOC operations from global SOCs. Comparable in delivery model, Splunk-centric heritage, and mid-to-large enterprise target customer to doIT.
• Expel: Expel provides transparent, tech-enabled MDR and managed SOC services across cloud, endpoint, network, identity, and SaaS — a direct functional analogue to doIT's SOC-in-a-Box modular portfolio, including alert engineering, SOAR automation, and KRITIS-style compliance support.
• ReliaQuest: ReliaQuest delivers managed detection and response and SOC-as-a-service built on a multi-vendor SIEM/EDR/NDR stack with GreyMatter automation — directly analogous to doIT's multi-vendor SOC Visibility Triad and SOAR-led automation. Both target enterprises that have Splunk/Palo Alto investments.
• Arctic Wolf: Arctic Wolf is a leading global pure-play managed SOC/MDR provider delivering concierge-style security operations as a subscription service to mid-market and enterprise customers. Same SOC-as-a-Service delivery model and end-customer pain points (alert fatigue, lack of in-house SOC talent, compliance).
• eSentire: eSentire is a global managed detection and response and 24/7 SOC operator with a multi-XDR, asset-aware threat response model. Comparable end-customer value proposition (continuous monitoring, alert triage, threat hunting) sold on a recurring subscription basis.
• I-TRACING: I-TRACING is doIT's majority owner and a French-headquartered pure-play MSSP delivering 24/7 managed SOC, MDR, and cybersecurity consulting across Europe with 1,000+ experts and 600+ customers. Same managed-services model, same Splunk/Palo Alto technology stack, same European mid-market and regulated-enterprise focus.

Regional players

• SEC Consult (Eviden): SEC Consult is a DACH-headquartered cybersecurity consulting and managed service firm offering SOC, incident response, and red-teaming services to regulated and KRITIS customers. A regional peer overlapping on the consulting and managed SOC side with doIT.

Broad incumbents

• NTT Security (Managed Security Services): NTT's Managed Security Services division delivers global 24/7 SOC, MDR, and SIEM-as-a-service offerings to enterprises including DACH-regulated firms. Larger, broader incumbent competing for the same compliance-driven managed SOC engagements.
• Orange Cyberdefense: Orange Cyberdefense is the cybersecurity arm of Orange Business, a large European incumbent offering managed SOC, MDR, threat intelligence, and consulting across multiple countries. Direct overlap with doIT/I-TRACING on managed SOC for European mid-market and critical-infrastructure customers, with broader portfolio scale.

Others

• securonix / Devo (SIEM-platform partner overlap): Securonix is a SIEM/SOAR platform vendor whose technology often underpins MSSP delivery models. Comparable as an enabling technology peer in the SIEM/SOAR stack that doIT's SOC-in-a-Box and Cyber Intelligence Service are built around.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks7 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/doit-solutions-gmbh

Compliance3 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles9 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about doIT solutions