Blueteam

What Blueteam does

Blueteam GmbH is a German managed cybersecurity services provider founded in 2017 and headquartered in Hannover, operating as the cybersecurity entity within the CRATOS Group. The company runs a 24/7 Security Operations Center in Germany that aggregates endpoint, network, and cloud telemetry into SIEM platforms (Elastic, Cortex, Wazuh), EDR, NDR, and SOAR tooling to deliver Managed Detection & Response (MDR), SOC-as-a-Service, Incident Response, Vulnerability Management, Firewall Management, Endpoint Security, and Cloud Security services. Its proprietary SOC Operations Console, MITRE ATT&CK-aligned detection use-case library, and tiered SOAR playbooks (L1-Triage, L2-Analyse, L3-Forensik) underpin service delivery, with published operational metrics of 23-minute MTTR under SLA and 1,842 monitored endpoints.

The company targets German Mittelstand, government authorities (Behörden), and critical infrastructure (KRITIS) operators in energy, water, healthcare, and public administration, exploiting the structural demand created by NIS2, DORA, ISO 27001, BSI Grundschutz, and GDPR requirements. Blueteam is ISO 27001 certified, a TeleTrusT member bearing the 'IT Security made in Germany' trust mark, and partners with Adesso (joint Managed SIEM on Wazuh), Palo Alto Networks, GLPI, Proxmox, SoSafe, Tenable, Elastic, Greenbone, Check Point, and Utimaco to extend its portfolio. It is led by founder/CEO Dr. Stefan Schwerdtner alongside managing directors Michael Damm and Matthäus Kozlowski.

Blueteam generates revenue through recurring managed-services contracts at fixed calculable flat rates (Pauschalen) bundled with ISO 27001-certified German-hosted operations, supplemented by project-based professional services (penetration testing, security consulting, network architecture, integration) and incident response engagements. Go-to-market is sales-led and consultative, with a free initial consultation within 24 hours and tiered paid Security Assessments (Basic €1,790, Standard €4,890, Premium €9,990) serving as lead-generation entry points, supported by industry events such as it-sa and Hannover Messe and partner-driven channels.

Name

Blueteam

Legal name

Blueteam GmbH

Website

https://blueteam.de

Company type

Private

Founded year

2017

Operating status

Operating

Headcount range

11–50 employees

Short description

Blueteam GmbH is a German managed cybersecurity services provider operating a 24/7 SOC in Hannover, delivering MDR, incident response, and compliance-focused security services to German Mittelstand, government authorities, and critical infrastructure operators.

Ownership category

akta.pro rank

Product category

Managed Security Services

NAICS

Security Systems Services (56162), Computer Facilities Management Services (541513), Other Computer Related Services (541519)

SIC

Services-Management Services (8741), Services-Computer Integrated Systems Design (7373)

akta.pro primary industry

Managed Security Services (MSSP) & 24/7 SOC Operations (BPAKAHAA)

akta.pro secondary industries

Security Operations Center (SOC) as a Service (BPAEADAB), Endpoint Security Managed Services (EDR/XDR) (BPAEADAH), Cybersecurity Management for SMB (Managed Security Add‑ons) (BPAEABAG)

Keywords

• Managed security services
• Security operations center
• Managed detection response
• Incident response services
• Vulnerability management

Headquarters

HQ city

Hanover

HQ country

Germany

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales

Revenue model

1. Managed Security Services: Recurring managed security services including SOC-as-a-Service, Managed Detection & Response (MDR), vulnerability management, firewall management, endpoint security, and cloud security. Revenue is generated through fixed-price contractual agreements (Pauschalen) with defined SLAs. Services operate from Germany with ISO 27001 certified processes.
2. Professional Services: Consulting services including strategic security consulting, penetration testing, security assessments, network architecture, and integration services. Offered as project-based engagements with modular, combinable packages.
3. Incident Response: Incident response services with defined playbooks, forensics, containment, and recovery. May be offered as retainer or on-demand engagement.
4. Managed SIEM (Blueteam + Adesso): Joint managed SIEM offering with Adesso using Wazuh Open-Source platform operated in Adesso's certified German Business Cloud. Combines SIEM technology, SOC expertise, and cloud infrastructure.

Pricing tiers

Go-to-market motion1 record

Distribution channels3 records

Marketing channels6 records

Core offering

Blueteam GmbH operates as a Managed Security Services Provider (MSSP) delivering 24/7 Security Operations Center (SOC), Managed Detection and Response (MDR), incident response, penetration testing, vulnerability management, phishing simulation, and ISO 27001 consulting. The company serves German mid-market enterprises, government authorities, and operators of critical infrastructure (KRITIS) from its Hannover headquarters with a fully Germany-based SOC.

Product overview

Blueteam is a managed cybersecurity services provider offering a unified portfolio of SOC, MDR, Incident Response, Penetration Testing, Vulnerability Management, Firewall Management, Endpoint Security, and Cloud Security services. The company operates a 24/7 Security Operations Center in Germany and offers three Security Assessment tiers (Basic, Standard, Premium). Partner solutions include Palo Alto Networks, GLPI (Silver Partner), Proxmox (Silver Partner), Utimaco, and Cyberdefense.ai. A notable addition is the Managed SIEM service developed with Adesso using Wazuh open-source platform. The offering also includes Professional Services (Network Architecture, Integration, Strategic Security Consulting) and is part of the CRATOS Group.

Differentiator

Problem solved

Functional benefit

Brands

• bt/log: Company blog covering cybersecurity insights, best practices, and industry news.

Products and services

• Managed Detection & Response (MDR)

Quantifiable outcome

• MTTR of 23 minutes under SLA (vs. days average dwell time for companies without SOC)
• +4 more outcomes

Named customers3 records

Segments3 records

Ideal customer profiles2 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration14 records

AI capability2 records

Feature4 records

Partnerships

Six partnerships are on record, tiered core, major and minor.

• GLPI NetworkcoreTechnology or Integration · 26 June 2025Blueteam is GLPI Network Silver Partner. GLPI is a European open-source ITSM and asset management solution. Blueteam leverages GLPI for customer implementations and positions solid asset/service management as the foundation for effective IT security. The partnership emphasizes European, transparent, and trustworthy digital infrastructure.
• AdessocoreStrategic or Co-development Partner · 6 February 2025Blueteam and Adesso jointly offer Managed SIEM services combining Blueteam's 24/7 SOC expertise with Adesso's certified Business Cloud infrastructure in Germany. The Wazuh-based open-source SIEM platform is operated in Adesso's cloud and monitored by Blueteam's security analysts, targeting Mittelstand companies needing enterprise-grade security with predictable costs.
• CRATOS GroupcoreStrategic or Co-development PartnerBlueteam is a member of the CRATOS Group, a verbund of specialized IT service providers for Mittelstand, government authorities, and critical infrastructure. The group includes Blueteam (Cybersecurity), Cratos (Digital Business Security and Transformation), Envyze (Sustainable Energy), and Cratos Can Inc. (Green Energy & Cybersecurity Canada). Blueteam hosts the CRATOS Industry Circle event jointly with the group.
• ProxmoxcoreTechnology or IntegrationBlueteam is Proxmox Silver Partner, certified for Proxmox Virtual Environment (VE) and Proxmox Backup Server (PBS). Services include consulting, architecture, implementation, migration (from VMware/Hyper-V), operations, and training for virtualization and backup solutions.
• Palo Alto NetworksmajorTechnology or IntegrationPartner for next-generation firewall and security platform solutions. Blueteam offers Palo Alto Networks as a solution option within their security portfolio, integrating the technology into customer environments.
• Cratos Can Inc.minorStrategic or Co-development PartnerRelated entity within the CRATOS Group, focused on Green Energy & Cybersecurity for the Canadian market. Part of the broader group ecosystem.

Scale indicators6 records

Recent moves6 records

Expansion highlights3 records

Broad incumbents

• Sophos (Managed Detection and Response): Global cybersecurity vendor offering MDR as a managed service layered on its EDR/XDR platform. Comparable managed detection offering for mid-market customers, with much larger product portfolio and brand.
• Trustwave: Global MSSP offering managed detection, response, and SOC services at scale. Broader portfolio than Blueteam but directly competes in the MSSP/MDR space with overlapping customer segments.
• Rapid7 (Managed Security Services): Global cybersecurity company offering managed SOC/MDR services alongside its Insight platform. Comparable managed detection and response capability with broader product portfolio and larger enterprise customer base.

Direct peers

• Kudelski Security: Swiss-headquartered cybersecurity services firm offering managed security, SOC, and incident response across Europe. Comparable mid-sized MSSP with European regulatory and data-residency focus.
• Secunet Security Networks AG: Germany-headquartered cybersecurity company focused on IT security for government, KRITIS, and critical infrastructure. Directly comparable to Blueteam's German Mittelstand/Behörden/KRITIS positioning and shares ISO 27001 and BSI credentials.
• eSentire: Pure-play MDR provider with 24/7 SOC operations and managed detection across endpoint, network, and cloud. Comparable managed detection and response service model targeting mid-market and enterprise customers.
• Orange Cyberdefense: European-headquartered MSSP/MDR provider operating 24/7 SOCs across multiple geographies. Closest large-scale European peer serving regulated and mid-market customers with German/European footprint overlap.
• Cybereason: MDR/EDR vendor offering managed detection, response, and SOC services globally. Comparable endpoint-centric detection and response capabilities, though more product-led than Blueteam's pure service model.
• ReliaQuest: US-based MDR/SOC platform provider delivering 24/7 detection and response across endpoint, network, and cloud telemetry. Direct competitor in the managed SOC/MDR category with comparable SIEM/EDR integration approach.
• Arctic Wolf Networks: Leading global MDR/SOC-as-a-service provider offering 24/7 managed detection and response. Directly comparable managed security service model, although Arctic Wolf is significantly larger and US-headquartered.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/blueteam-gmbh

Compliance7 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Blueteam