What DFN-CERT does

DFN-CERT Services GmbH is the designated Computer Security Incident Response Team (CSIRT) for the German Research Network (DFN), founded circa 1993 and headquartered in Hamburg, Germany. The company provides IT security services exclusively to institutions participating in the DFN, including German universities, research institutions, and academic organizations. Its service portfolio spans incident response coordination, German-language CVSSv3.1-based vulnerability advisories, SOC-based log data analysis, DNS Response Policy Zone (DNS-RPZ) services including SWITCH RPZ integration, PKI infrastructure for certification authorities, honeypot and darknet monitoring, network scans, and an automated warning service. Log data ingestion is enabled through SOC-Connector, an open-source component hosted on Codeberg that member institutions install locally to transmit logs into DFN-CERT's analysis platform.

The company operates a member-funded revenue model: services are made available exclusively through DFN-Verein (Verein zur Förderung eines Deutschen Forschungsnetzes) membership, with no public pricing or self-serve catalog. Access requires signed service agreements administered through the DFN-Verein. DFN-CERT holds distinguished institutional credentials including full membership in FIRST, founding membership in the German CERT-Verbund and EDUCV, and Trusted Introducer accreditation, and participates in European research projects including GEANT (via Horizon 2020 GN4-3), CarmentiS, NoAH, GridIDS, and SKIMS. The company also operates two major annual conferences — the DFN-Konferenz 'Sicherheit in vernetzten Systemen' (34th edition in February 2027) and the DFN-Konferenz Datenschutz (13th edition in November 2026) — alongside a training program that includes a certified Information Security Officer course.

Name

DFN-CERT

Legal name

DFN-CERT Services GmbH

Website

https://dfn-cert.de

Company type

Private

Founded year

1993

Operating status

Operating

Headcount range

51–100 employees

Short description

DFN-CERT Services GmbH is the designated CSIRT for the German Research Network, providing incident response coordination, vulnerability advisories, security operations, and PKI services to German universities and research institutions funded through DFN-Verein membership.

Ownership category

akta.pro rank

Product category

Cybersecurity CSIRT Services

NAICS

Computer Systems Design and Related Services (5415), Other Computer Related Services (541519), Other Scientific and Technical Consulting Services (54169), Security Systems Services (except Locksmiths) (561621)

SIC

Services-Computer Programming, Data Processing, Etc. (7370), Services-Engineering, Accounting, Research, Management (8700)

akta.pro primary industry

Network Security Managed Services (Firewall/IDS/IPS/SASE) (BPAEADAG)

akta.pro secondary industries

Network Security Services (Firewall/VPN/ZTNA/SASE Integration) (BPAEAEAG), DNS Security & Protective DNS (HDADABAF), Insider Threat Program Design & Risk Assessments (BPAKADAM)

Keywords

• Incident response services
• Vulnerability advisories
• Security operations center
• DNS threat protection
• Public key infrastructure

Headquarters

HQ city

Hamburg

HQ country

Germany

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Infrastructure, Operations, Marketing or Sales

Revenue model

1. DFN-Verein Membership-Funded Services: DFN-CERT is funded by the DFN association (Verein zur Förderung eines Deutschen Forschungsnetzes - DFN-Verein). Services including incident response coordination, security advisories, and the DFN-Security service are made available to institutions participating in the DFN through membership. Specific service tiers and associated costs are managed through contractual agreements with the DFN-Verein rather than public pricing.

Go-to-market motion2 records

Distribution channels3 records

Marketing channels6 records

Core offering

DFN-CERT Services GmbH is the dedicated Computer Security Incident Response Team (CSIRT) for the German Research Network (Deutsches Forschungsnetz), providing coordinated incident response, German-language vulnerability advisories based on CVE/CVSSv3.1, and a DFN-Security operations platform that includes log data analysis (via the open-source SOC-Connector) and DNS Response Policy Zone (DNS-RPZ) protection. It also operates certification authorities for PKI and delivers tutorials, certified Information Security Officer training, and major annual security conferences for the German research and education constituency.

Product overview

DFN-CERT Services GmbH offers a portfolio of cybersecurity services centered on its DFN-Security platform for German Research Network (DFN) institutions. The core offerings include Security Advisories (vulnerability advisories in German with CVE tracking), Incident Response coordination for DFN constituency, and Security Operations (log data analysis via SOC-Connector and DNS-RPZ for blocking malicious domains). Additional services encompass PKI operations, honeypot/darknet monitoring, and professional education including tutorials and a certified Information Security Officer training program. The company also organizes two major annual conferences: the DFN-Konferenz 'Sicherheit in vernetzten Systemen' and the DFN-Konferenz Datenschutz.

Differentiator

Problem solved

Functional benefit

Brands

• DFN-CERT Services GmbH: The full legal and trading name of the company providing IT security services for the German Research Network (DFN).
• DFN-Security
• DFN-CERT Training Programme

Products and services

• DFN-Security Basisleistungen (DFN-Security Base Services) Core security service package providing foundational DFN-CERT security services to DFN participants, including incident response coordination and vulnerability advisories, accessible to DFN-Verein member institutions.
• SOC-Connector Open-source component (hosted on Codeberg) that customers install on their own systems to securely transmit log data to DFN-CERT's analysis platform for security monitoring.
• Log Data Analysis (Logdatenanalyse) Security analysis service where DFN-CERT examines log data transmitted by customers via SOC-Connector, providing security insights, anomaly detection, and threat intelligence for DFN member institutions.
• DNS-RPZ (DNS Response Policy Zone) DNS security service enabling DFN customers to block access to malicious domains through DFN-CERT's DNS resolution policy zones, with integration of SWITCH RPZ threat intelligence and a community zone feature.
• Security Advisories German-language vulnerability advisories enriched with background information, aggregating CVE identifiers and CVSSv3.1 scoring, distributed to interested users across the DFN constituency.
• Incident Response Coordination

Quantifiable outcome

• Approximately 350 participants attend the DFN-Konferenz 'Sicherheit in vernetzten Systemen' on average, making it one of the largest German security conferences
• +1 more outcomes

Segments2 records

Ideal customer profiles2 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration2 records

AI capability2 records

Feature6 records

Partnerships

Ten partnerships are on record, tiered core, major and minor.

• DFN-Verein (Verein zur Förderung eines Deutschen Forschungsnetzes)coreStrategic or Co-development PartnerDFN-CERT is the designated CSIRT for the German Research Network (DFN). The DFN-Verein (association for the promotion of the German Research Network) provides funding and organizational support to DFN-CERT. DFN-CERT's mandate is to coordinate and investigate security incidents for DFN participants, and its constituency consists of all institutions participating in the DFN.
• Trusted IntroducercoreStrategic or Co-development PartnerDFN-CERT is an accredited and certified Trusted Introducer (TI) team. TI is a European certification body for trusted and verified CSIRTs and CERTs, providing a trusted framework for inter-team cooperation and credentialing.
• FIRST (Forum of Incident Response and Security Teams)coreStrategic or Co-development PartnerDFN-CERT is a full member of FIRST, the premier international organization bringing together incident response and security teams from government, commercial, and educational sectors. Membership enables cross-border incident response coordination and threat intelligence sharing.
• CERT-Verbund (German CERT Alliance)coreStrategic or Co-development PartnerDFN-CERT is a founding member of the German CERT alliance (CERT-Verbund), a coordination body uniting German CSIRTs and CERTs for national incident response cooperation, threat intelligence sharing, and joint initiatives such as the CarmentiS early warning system project.
• GEANT (Pan-European Research Network)majorStrategic or Co-development PartnerDFN-CERT participates in the GEANT project, which connects 26 national research networks across Europe via exclusive multi-gigabit links. DFN-CERT contributes in the Security Research area and provides PKI services within the GEANT framework, including through the Horizon 2020 GN4-3 project (Grant Agreement No. 856726).
• CarmentiS (German IT Early Warning System)majorStrategic or Co-development PartnerCarmentiS is a joint project of the German CERT-Verbund and the BSI (Bundesamt für Sicherheit in der Informationstechnik) to trial a sensor network as the basis for a national IT early warning system in Germany. DFN-CERT co-develops a security architecture for cross-organizational data correlation, threat analysis, and situational awareness for CERTs and national operational stakeholders.
• NoAH (European Network of Affined Honeypots)minorStrategic or Co-development PartnerNoAH was a completed EU project that built a European honeynet to detect novel attack methods early. DFN-CERT contributed to the project and continues to leverage the sensor technology developed within NoAH in subsequent projects such as GEANT3 and CarmentiS.
• GridIDS (Grid Intrusion Detection System)minorStrategic or Co-development PartnerGridIDS was a project aimed at developing, designing, and deploying a Grid-based Intrusion Detection System (GIDS) for securing the D-Grid infrastructure, and transitioning it to production operation. DFN-CERT participated in its development.
• SKIMS (Mobile Phone Security - 'Digital Immune System')minorStrategic or Co-development PartnerSKIMS was a project funded by the German Federal Ministry of Education and Research (BMBF) to develop lightweight, intelligent detection and defense software for mobile devices. DFN-CERT participated in this research alongside other institutions.
• EDUCV (European Confederation for e-Security Research and Education)minorStrategic or Co-development PartnerDFN-CERT is a founding member of EDUCV, the European Confederation for e-Security Research and Education, contributing to European cooperation in cybersecurity research and education.

Scale indicators4 records

Recent moves6 records

Expansion highlights5 records

Broad incumbents

• BSI (Bundesamt für Sicherheit in der Informationstechnik): German federal cybersecurity agency with overlapping mandate in national CSIRT coordination and joint projects (CarmentiS) — broader scope, regulator-grade authority and a wider constituency than DFN-CERT.

Others

• GÉANT: Pan-European research network in which DFN-CERT participates via Security work packages and PKI services — comparable in mission and constituency ecosystem, but operates as a network rather than a single CSIRT.
• Trusted Introducer (TF-CSIRT): European accreditation framework for CSIRTs in which DFN-CERT holds certified status — peer via shared credentialing ecosystem rather than direct competition.

Direct peers

• REN-ISAC: Information sharing and analysis organisation for the global research and education networking community — comparable constituency (NREN/R&E) and similar CSIRT-adjacent trust framework.
• SWITCH-CERT: CSIRT for the Swiss research and education network (SWITCH), providing incident response, threat intelligence and DNS-RPZ services to a similar NREN constituency — directly comparable function and scope, and already integrated with DFN-CERT via SWITCH RPZ.
• SURFcert (SURF): Dutch NREN (SURF) security team performing incident response, security advisories and SOC services for Dutch universities and research institutions — direct NREN-CSIRT peer.
• Jisc Cyber Security: UK NREN (Jisc) security operations serving universities and colleges with incident response, threat intelligence and security guidance — analogous NREN-CSIRT role for a large research constituency.
• CERT.at: Austrian national CERT providing incident coordination, advisories and security services — overlaps with DFN-CERT's mandate within the German-speaking research/security ecosystem.

Regional players

• Belnet CERT: CERT for Belgium's federal research network (Belnet), delivering incident response and DNS security to Belgian research institutions — same NREN-CSIRT function in a different geography.
• HEAnet NSAC: Security operations for Ireland's NREN (HEAnet), serving higher-education and research institutions — comparable NREN-CSIRT role in a separate national market.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights6 records

Customer concentration

• Xinfosec.exchange/@dfncert
• LinkedInlinkedin.com/company/dfn-cert-services-gmbh

Compliance3 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles7 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about DFN-CERT