What SBA Research does

SBA Research is a Vienna-based, non-profit cybersecurity research center founded in 2006 and organized as SBA Research gGmbH. It operates as a COMET Center for Next Generation Cybersecurity (SBA-K1 NGC), publicly funded through the Austrian FFG with co-financing from federal ministries BMIMI and BMWET and the state of Vienna, and employs roughly 100 researchers and staff. The organization runs multiple research groups spanning mathematics-for-security, machine learning and data management, decentralized systems, IoT and industrial systems security, networks and critical infrastructure, and complexity/resilience, publishing in top-tier venues such as ACM CCS, USENIX Security, and RAID.

SBA Research monetizes across three streams: (1) institutional COMET research funding as the core base; (2) fee-based professional services delivered by an ISO 27001:2022-certified and SWIFT CSP-approved team covering software, cloud, infrastructure, IoT/hardware, and governance security consulting and testing; and (3) commercial security training programs (CISSP, SOC, secure coding, container security, machine learning security) delivered on-site in Vienna and virtually. Its market position is reinforced by CVE Numbering Authority status, an ERC Advanced Grant among its scientific leadership, and high-profile disclosures such as the November 2025 WhatsApp Contact Discovery vulnerability affecting approximately 3.5 billion accounts.

The customer base spans European enterprises (security testing and consulting), academic institutions (joint research, PhD supervision with University of Vienna and TU Wien), financial institutions (SWIFT CSP assessments), and regulators/industry consortia (AI-in-cybersecurity studies, Linux Foundation Europe open-source work). GTM is sales-led and community-led, anchored by direct professional-services engagement, conference participation (ARES co-organization, BSidesVienna sponsorship, Black Hat Europe), and the Shecurity initiative to broaden the women-in-cybersecurity pipeline.

Name

SBA Research

Legal name

SBA Research gGmbH

Website

https://sba-research.org

Company type

Private

Founded year

2006

Operating status

Operating

Headcount range

101–250 employees

Short description

SBA Research is a Vienna-based, non-profit cybersecurity research center (COMET Center SBA-K1 NGC, founded 2006) that combines publicly funded research with ISO 27001-certified professional security services, SWIFT CSP assessments, and commercial training for European enterprises, financial institutions, academia, and public-sector clients.

Ownership category

akta.pro rank

Product category

Cybersecurity Research and Professional Services

NAICS

Computer Systems Design and Related Services (54151), Scientific Research and Development Services (5417)

akta.pro primary industry

Threat & Vulnerability Assessments (TVA) (BPAKADAD)

akta.pro secondary industries

Management Research Institutes & Doctoral (PhD/DBA) Programs (EDAHAHAO), Research Administration & Compliance (Sponsored Programs, IRB/REB) (EDADAKAH), Research Administration & Grants Management Support (Pre/Post-Award, Compliance) (EDAEALAO), Software Supply Chain & Dependency Security (SBOM, Signing) (HDADACAD)

Keywords

• Cybersecurity research
• Security consulting
• Penetration testing
• Security training
• Vulnerability assessment

Headquarters

HQ city

Vienna

HQ country

Austria

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. Research Funding (COMET Programme): SBA Research operates as a COMET Center (SBA-K1 NGC) funded by Austrian national initiative BMIMI, BMWET, and Vienna through FFG, representing core institutional funding for cybersecurity research activities
2. Professional Security Services: Fee-based security consulting, testing, audits, and assessments including software security, cloud security, infrastructure security, IoT/hardware security, and governance services delivered to enterprise clients
3. Security Training Programs: Commercial training offerings including CISSP preparation courses, SOC fundamentals, secure coding, container security, and specialized cybersecurity workshops offered on-site and virtually
4. Swift CSP Assessments: Certified security assessments for SWIFT financial messaging network participants, delivering compliance evaluations under SWIFT's Customer Security Programme

Go-to-market motion3 records

Distribution channels3 records

Marketing channels5 records

Core offering

SBA Research operates as a COMET Center for Next Generation Cybersecurity, providing professional security services (software, cloud, infrastructure, IoT/hardware, and governance security testing and consulting), commercial security training programs (CISSP, SOC, secure coding, cloud security), and SWIFT CSP compliance assessments for enterprise clients and financial institutions. The organization also conducts applied cybersecurity research projects and publishes security advisories.

Product overview

SBA Research is a cybersecurity research center in Vienna, Austria, operating as a COMET Center funded by the Austrian Research Promotion Agency. The organization offers a portfolio of security research services, professional consulting services, and security training programs. The core offerings include applied research projects addressing cybersecurity challenges, professional services spanning software security, cloud security, infrastructure security, IoT/hardware security, and people-centric security, along with security training courses covering topics such as API security, AWS cloud security, container security, and threat modeling. SBA Research does not offer a singular commercial product but rather provides research-driven security services and training to industry partners and academic institutions.

Differentiator

Problem solved

Functional benefit

Products and services

• Professional Security Services Fee-based security consulting, testing, and audit services covering software security, cloud security, infrastructure security, IoT/hardware security, security governance, and people-centric security for enterprise clients across the DACH region.
• SWIFT Customer Security Programme Assessments Certified security assessments for SWIFT financial messaging network participants, delivering compliance evaluations under the SWIFT Customer Security Programme. SBA Research holds the SWIFT CSP Assessment Provider label and is authorized to validate CSP controls for financial institutions.
• Security Training Programs Commercial instructor-led training courses covering API Security, AWS Cloud Security, CISSP preparation, Container Security, Cyber Security Fundamentals, Machine Learning Security, Secure Coding, SOC fundamentals, Threat Modeling, and Web Application Hacking. Delivered on-site in Vienna, at client premises, and virtually.
• I-SEE (Integrated Software Ecosystem Evaluation) Training Applied research translation offering that trains organizations in the I-SEE framework for software quality and security assessment, adapting Assembly Theory concepts to ecosystem-level analysis of code modules, dependencies, and development contributions.
• Open-Source-Based Security Operations Center (SOC) Implementation Applied service helping organizations design and implement SOC capabilities using open-source tooling, paired with expert advisory for SOC operations.
• CRA Readiness Workshop for Industrial Products Workshop offering for industrial product manufacturers covering Cyber Resilience Act (CRA) compliance preparation, from threat modeling through to required processes.
• SBA Security Advisories Published security advisories disclosing vulnerabilities discovered by SBA researchers, including CVE assignments and responsible disclosure notifications for affected vendors.
• COMET Center SBA-K1 NGC Research Program COMET-funded research program bridging fundamental cybersecurity research with practical applications across software, cloud, infrastructure, IoT/hardware, and people-centric security domains.

Named customers3 records

Segments4 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature4 records

Partnerships

Eight partnerships are on record, tiered core and minor.

• University of ViennacoreStrategic or Co-development Partner · 1 January 2006Long-standing research partnership with University of Vienna Faculty of Computer Science, including joint research groups, PhD supervision, and collaborative publications. Edgar Weippl serves as full professor for security & privacy at University of Vienna while directing SBA Research.
• TU Wien (Vienna University of Technology)coreStrategic or Co-development PartnerPartnership led by Matteo Maffei connecting academic excellence with applied research. TU Wien collaboration strengthens Vienna's cybersecurity ecosystem through joint research and industry engagement.
• CondignumcoreStrategic or Co-development PartnerIndustrial partner in I-SEE project providing proprietary, security-critical codebases for validation of software quality and security assessment framework.
• Linux Foundation EuropeminorStrategic or Co-development PartnerSBA Research joined Linux Foundation Europe to strengthen commitment to advancing security and resilience in digital infrastructures and open-source community.
• AIT Austrian Institute of TechnologyminorStrategic or Co-development PartnerSBA Research participates in TestCat project led by AIT investigating how Internet measurements serve automated testbed generation for intrusion detection evaluation.
• Complexity Science HubminorStrategic or Co-development PartnerCollaboration on cryptocurrency key reuse research identifying over 1.6M reused ECDSA secp256k1 keys across major blockchain networks.
• CISPA Helmholtz Center for Information SecurityminorStrategic or Co-development PartnerJoint research with CISPA on VoWiFi vulnerabilities affecting Austrian mobile operators, combining Saarbrücken expertise with Austrian researchers.
• Arizona State UniversityminorStrategic or Co-development PartnerProfessor Violet Syrotiuk visited MATRIS research group for intensive research discussions on mathematical system dynamics modeling and wireless networks.

Scale indicators5 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• SEC Consult: Vienna-headquartered cybersecurity consulting firm offering penetration testing, red teaming, and security assessments across DACH and globally. Most direct functional overlap with SBA's Professional Services arm in software, infrastructure, and IoT security testing.
• AIT Austrian Institute of Technology: Austria's largest non-university research center, a partner of SBA Research on projects like TestCat. Comparable as a domestic Austrian applied research institution co-funded by federal ministries that translates research into commercial and government engagements.
• Cure53: Berlin-based boutique security research and penetration testing firm with a strong publication record and CVE discovery history. Comparable to SBA in its research-driven consulting model and emphasis on high-impact vulnerability disclosure.
• Fraunhofer FKIE: German Fraunhofer Institute for Communication, Information Processing and Ergonomics, focused on applied cybersecurity research and federal/government contracts. Closest structural analog to SBA as a publicly funded applied research center that also delivers security services.

Broad incumbents

• NCC Group: Global cybersecurity consulting and software assurance firm. Overlaps with SBA's Professional Services portfolio in software/infrastructure testing and security advisory, but operates at a significantly larger commercial scale across multiple continents.
• IOActive: US-headquartered security consulting firm specializing in penetration testing, IoT/hardware, and application security assessments. Directly comparable to SBA's testing and IoT/hardware security practice, though with broader geographic reach.
• SANS Institute: Global cybersecurity training and certification organization. Overlaps directly with SBA's Security Trainings portfolio (CISSP preparation, SOC fundamentals, secure coding, container security) at significantly greater global scale.
• CISPA Helmholtz Center for Information Security: Germany's national Helmholtz Center for cybersecurity research and a documented SBA collaborator on VoWiFi research. Comparable in scale of publication output, ERC-grant talent base, and applied security services orientation.
• TÜV Austria: Austrian testing, inspection, and certification body. Comparable to SBA's ISO 27001-certified Professional Services and certification-related training offerings, but operating as a much larger generalist TIC player.

Emerging players

• Complexity Science Hub: Vienna-based research center that has co-authored cryptocurrency key-reuse research with SBA. Comparable as an Austrian research-focused organization with adjacent cybersecurity and complex-systems research, but not a commercial security services competitor.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/sba_research
• GitHubgithub.com/sba-research
• LinkedInlinkedin.com/company/secure-business-austria
• Facebookfacebook.com/sbaresearch

Compliance3 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles8 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about SBA Research