CICS

What CICS does

CICS GmbH is a Swiss cybersecurity firm headquartered in Baar, Canton Zug, operating as a wholly-owned subsidiary of strykerONE GmbH since June 2021 (with operations continuously since 2020). It sells Managed Counter Intelligence Services to regulated enterprises in Central Europe, with named focus verticals in Energy & Utilities, Government, Aviation, and Critical Infrastructure. The firm targets buyers concerned about targeted attacks that evade conventional security stacks, and uses Swiss data residency and a sovereign Treuhand operating model to differentiate from US-headquartered vendors subject to the CLOUD Act and FISA Section 702.

The product portfolio comprises four managed services under a "Proactive by Design" methodology. SENTINEL detects adversarial infrastructure during the staging phase before attacks land, delivering pre-disclosure records with lifecycle, confidence basis, and recommended actions; live public statistics show ~2.98M malicious indicators tracked, 653 public confirmations, and a 17-day median lead time over public sources. HARBINGER maps attack paths connecting leaked credentials, exposed surface, and routes to crown jewels, validated against the customer's real environment. VANGUARD deploys instrumented deception terrain inside customer estates under a sovereign Treuhand model with on-premises-by-default operation and full query logging, producing finished intelligence including adversary profiles and detection content (Sigma, YARA, SIEM, IDS). HELVETIC SHIELD is a DACH community that pools perimeter telemetry across member organisations, with member-hosted research pods contributing sensor diversity rather than staff. Bespoke engagements (Defence Validation, Detection Engineering, Custom Intelligence Analysis) sit alongside the managed services. Public-facing artefacts include a live SENTINEL dashboard at sentinel.cics.ch, an AI Transparency Labels framework signed with PGP/Ed25519, and the unsponsored German-language ZweiOnCTI podcast.

CICS runs a consultative direct enterprise sales motion with no public pricing, sales decks, or on-demand demos; engagements begin with a fit conversation. Revenue is generated via recurring subscriptions for managed services (SENTINEL, HARBINGER, VANGUARD), a flat annual fee for HELVETIC SHIELD community membership, and bespoke professional services. The firm reports 1-10 employees, holds no disclosed external funding, and operates under Jan Dubs as Managing Director (Geschäftsführer) with sole signing authority. All customer references are available only under NDA.

Name

CICS

Legal name

CICS GmbH

Website

https://cics.ch

Company type

Private

Founded year

2021

Operating status

Operating

Headcount range

1–10 employees

Short description

CICS GmbH is a Swiss cybersecurity firm providing managed counter-intelligence services to regulated enterprises in Central Europe. It offers preemptive threat intelligence, attack-path mapping, deception-based adversary engagement, and a DACH community intelligence pool, all under Swiss jurisdiction.

Ownership category

akta.pro rank

Product category

Managed Counter Intelligence Services / Cybersecurity Threat Intelligence

NAICS

Investigation and Security Services (5616), Security Systems Services (56162)

SIC

Services-Detective, Guard & Armored Car Services (7381)

akta.pro primary industry

Critical Infrastructure Protection (CIP) & NERC-CIP Compliance (HDADAJAC)

akta.pro secondary industry

Security Governance, Risk & Compliance (GRC) Advisory (BPAKADAG)

Keywords

• Managed counter intelligence
• Preemptive threat intelligence
• Attack path intelligence
• Adversary engagement services
• Sovereign cyber intelligence

Headquarters

HQ city

Baar

HQ country

Switzerland

HQ region

Europe

Offices2 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Infrastructure, Marketing or Sales

Revenue model

1. Managed Services - SENTINEL, HARBINGER, VANGUARD: Recurring managed services with collaborative service model. SENTINEL runs detect-first observation phase before enforcement. HARBINGER and VANGUARD operated end-to-end by CICS with nothing for customers to staff. Intelligence remains CICS-owned in Switzerland.
2. HELVETIC SHIELD Community: DACH research community with flat annual fee regardless of organization size. Members host research pods contributing visibility rather than staff. Priority Intelligence Requirements owned by members.
3. Bespoke Engagements: Tailored engagements including Defence Validation, Detection Engineering, and Custom Intelligence Analysis. References available on request under NDA. Professional services model scoped to specific customer requirements.

Pricing tiers

Go-to-market motion1 record

Distribution channels1 record

Marketing channels4 records

Core offering

CICS provides managed counter intelligence services to regulated organizations in Central Europe, delivered through four proprietary service pillars: SENTINEL (preemptive threat intelligence detecting adversarial infrastructure during staging), HARBINGER (managed attack path intelligence connecting credential leaks, exposed surfaces, and routes to crown jewels), VANGUARD (sovereign treuhand adversary engagement deploying in-estate deception terrain), and HELVETIC SHIELD (a DACH perimeter intelligence community). The offering is complemented by bespoke engagements covering defence validation, detection engineering, and custom intelligence analysis, with all intelligence remaining analyst-validated and resident in Swiss jurisdiction.

Product overview

CICS (Managed Counter Intelligence Services) is a Swiss cybersecurity firm offering a portfolio of four managed services plus bespoke professional engagements. The core services address different stages of the adversary lifecycle: SENTINEL provides preemptive threat intelligence by detecting staging infrastructure before attacks land; HARBINGER delivers managed attack path intelligence connecting leaked credentials, exposed surface, and routes to crown jewels; VANGUARD provides sovereign Treuhand adversary engagement via in-estate deception technology; and HELVETIC SHIELD is a DACH community pooling perimeter-threat data across member organizations. All intelligence is analyst-validated against the customer's real environment before delivery. Data residency is maintained in Switzerland, beyond foreign access law reach.

Differentiator

Problem solved

Functional benefit

Brands

• SENTINEL: Preemptive Threat Intelligence - detects adversarial infrastructure during its staging phase before attacks land.
• HARBINGER
• VANGUARD
• HELVETIC SHIELD

Products and services

• SENTINEL Preemptive Threat Intelligence service that detects adversarial infrastructure during the staging phase — while domains are being registered and servers provisioned — and flags it before any of it is used against the customer. Outputs pre-disclosure records with lifecycle, confidence basis, and recommended action (block, sinkhole, or watch). Targeted at regulated organizations in critical infrastructure, government, energy, and aviation sectors.
• HARBINGER Managed Attack Path Intelligence that connects leaked credentials, exposed surfaces, and privilege relationships into the actual route an attacker would walk to crown jewels, validated against the customer's real environment from outside in and inside out by CICS analysts. Targeted at regulated organizations running critical infrastructure and high-value digital estates.
• VANGUARD Sovereign Treuhand Adversary Engagement that deploys instrumented terrain (systems, identities, services, traces) along paths an operator would walk inside a customer estate. When triggered, CICS reads every step and delivers finished intelligence — briefings, adversary profiles, and detection content (Sigma, YARA, SIEM, IDS) wired into the customer's stack. Operated as a neutral custodian with on-premises by default.
• HELVETIC SHIELD DACH Perimeter Intelligence Community where member organizations host research pods at their internet edge; CICS designs, deploys, fidelity-tests, and operates every pod, curates the shared pool, and feeds intelligence back to every member. Community sized by sensor diversity with a flat annual fee regardless of organization size. Data stays in DACH jurisdiction beyond US CLOUD Act reach.
• Bespoke Engagements Tailored engagements including Defence Validation (reproducing real adversary behavior under controlled conditions), Detection Engineering (custom detection rules built for the customer's stack), and Custom Intelligence Analysis (ransomware leak exposure, supply chain compromise assessment, credential cascade analysis, sector-specific threat actor profiling). References available on request under NDA.
• SENTINEL Public Dashboard Live public record of SENTINEL's preemptive threat intelligence work, displaying indicators observed, when they were first seen, lead time ahead of public sources, production cadence, lead time trends, lead time distribution, and corpus coverage statistics. Verification of CICS's 17-day median lead time over public sources.

Quantifiable outcome

• 17-day median lead time ahead of public sources (SENTINEL)
• +2 more outcomes

Segments4 records

Ideal customer profiles4 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability4 records

Feature7 records

Partnerships

Two partnerships are on record, tiered core.

• strykerONE GmbHcoreOthers · 18 June 2021CICS GmbH is a wholly owned subsidiary of strykerONE GmbH, Switzerland. CICS GmbH is a strykerONE company. Parent company structure providing corporate governance and potentially shared resources across the strykerONE group of companies.
• HELVETIC SHIELD Member OrganizationscoreStrategic or Co-development PartnerDACH research community where member organizations host research pods at their own internet edge. CICS designs, deploys, fidelity-tests and operates every pod, curates the community pool, and feeds intelligence back to every member. Members contribute visibility rather than staff. Data stays in DACH jurisdiction. Community sized by sensor diversity with flat annual fee regardless of organization size.

Scale indicators4 records

Recent moves6 records

Expansion highlights5 records

Broad incumbents

• Mandiant: Mandiant (now part of Google Cloud) provides managed threat intelligence, incident response, and bespoke adversary emulation engagements to enterprise and government buyers. It is comparable to CICS because both offer analyst-validated intelligence plus tailored adversary-simulation work (Mandiant's Red Team / Defence Validation maps to CICS's Bespoke Engagements), though Mandiant operates globally at significantly greater scale.
• Recorded Future: Recorded Future is a large incumbent threat intelligence platform that ingests data across the open, dark, and deep web to deliver finished intelligence to enterprise and government customers. It is broadly comparable to CICS because both sell managed threat intelligence with an emphasis on finished, actionable output, though Recorded Future operates at hyperscaler scale and CICS at a sovereign, DACH-niche scale.

Regional players

• InfoGuard: InfoGuard is a Swiss managed security services provider and CERT operator serving enterprise and public-sector customers in Switzerland and Liechtenstein with SOC, incident response, and consulting. It is comparable to CICS as another Swiss-headquartered cybersecurity firm serving regulated organisations in the DACH region with managed delivery and CIP-relevant services.
• Oneconsult: Oneconsult is a Switzerland-based cybersecurity firm offering penetration testing, incident response, and managed security services to enterprise clients in the DACH region. It is comparable to CICS as a fellow Swiss cybersecurity provider serving regulated enterprise customers in the same geographic market, though Oneconsult is more offence-testing oriented while CICS is intelligence-led.

Direct peers

• ThreatQuotient: ThreatQuotient provides a threat intelligence platform (TIP) and managed services that operationalise CTI across enterprise SOCs, with a focus on data-driven prioritisation and integrations. It is directly comparable to CICS because both sit in the threat intelligence operations stack and target regulated enterprise buyers, though ThreatQuotient sells a platform while CICS sells finished managed intelligence.
• EclecticIQ: EclecticIQ is a Europe-based threat intelligence platform vendor serving enterprise, government, and MSSP customers with CTI tooling and managed services. It is directly comparable to CICS because both target European regulated buyers with a finished-intelligence approach and emphasise analyst-led workflows rather than pure automation.
• Thinkst Canary: Thinkst Canary builds and operates honeypot/deception appliances that detect adversary activity inside customer environments and produce finished alerts. It is directly comparable to CICS's VANGUARD service, which similarly deploys instrumented terrain inside customer estates and converts triggered events into detection content and adversary profiles.

Emerging players

• Arctic Wolf: Arctic Wolf delivers managed security operations including managed detection, response, and security awareness, with a subscription model targeted at mid-market and enterprise buyers. It is comparable to CICS because both sell recurring managed security services with end-to-end operations rather than self-serve tooling, though Arctic Wolf's focus is broader MDR rather than threat-intelligence-first delivery.
• Acalvio Technologies: Acalvio provides enterprise deception technology (ShadowPlex) that detects adversary activity inside customer estates using distributed decoys and identity deception. It is comparable to CICS's VANGUARD service, which similarly plants instrumented terrain inside customer environments and delivers finished intelligence when adversaries interact with it, though Acalvio is a tooling vendor and CICS runs the deception operation as a managed service.

Others

• MISP Project: MISP is an open-source threat intelligence sharing platform used by CIP communities, governments, and enterprises to pool indicators and share adversary intelligence. It is comparable to CICS's HELVETIC SHIELD community model, which similarly pools perimeter-threat data across DACH organisations, though MISP is a free software platform and CICS operates the curated pool as a paid managed service.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks6 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/cics-cert

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about CICS