CSIRT-MU

What CSIRT-MU does

CSIRT-MU (Computer Security Incident Response Team of Masaryk University) is the in-house cybersecurity unit of Masaryk University's Institute of Computer Science in Brno, Czech Republic, founded in 2009 and reorganized as an independent division within the Institute in 2023 under Tomáš Plesník. The team protects the university's network — covering the 147.251.0.0/16 IPv4 range, the 2001:718:801::/48 IPv6 range, and the muni.cz domain — by handling security incidents (DoS attacks, phishing, malware, port scanning), publishing threat warnings, running penetration tests, and delivering user and IT-administrator education, with formal authority codified in Masaryk University Directives No. 9/2017 and No. 10/2017. As the first Trusted Introducer-certified CSIRT in the Czech Republic (2016), CSIRT-MU combines operational security services with applied research across six teams: Incident Response, Threat Management, Data Analytics, Technological Development, Applied Research, and Awareness and Training, totaling 40+ staff.

The unit maintains an active research and development portfolio funded primarily by the Czech Ministry of Interior (OPSEC, IMPAKT 1), the Ministry of Education (CRP-Kyber across 26 Czech public universities), the Technology Agency of the Czech Republic (TREND, NC3 National Competence Center for Cybersecurity), and EU framework programs (Horizon Europe ResilMesh, Digital Europe SOCCER, Horizon 2020 CONCORDIA and SAPPAN). Proprietary platforms include KYPO Cyber Polygon (an open-source cyber range that won the European Commission Innovation Radar 2020 award in Disruptive Technology) and Stream4Flow (real-time network data analysis). Current research projects (Andromeda, AICA-CONNECT, SECURIAN) build ML-based tools for automated telemetry analysis, autonomous cybersecurity, and drill-down incident investigation, with outputs published at venues such as NOMS 2024 and CNSM 2025.

CSIRT-MU is a non-commercial research and operational unit; all services to Masaryk University students and staff are free, and there is no productized revenue. Funding flows from Masaryk University's core budget and from competitive research grants awarded by Czech government agencies and the European Commission, supplemented by cost-sharing partnerships with CESNET (national research network), FlowMon Networks, GÉANT, and university partners (JOANNEUM RESEARCH, University of Murcia). Distribution is primarily direct to the MU community, coordinated to other Czech universities through MŠMT-funded CRP-Kyber, and extended globally through open-source tool releases on GitHub and through Trusted Introducer / TF-CSIRT / ENISA ecosystem participation.

Name

CSIRT-MU

Legal name

CSIRT-MU: Computer Security Incident Response Team of Masaryk University

Website

https://csirt.muni.cz

Company type

Private

Founded year

2009

Operating status

Operating

Headcount range

11–50 employees

Short description

CSIRT-MU is the cybersecurity incident response team of Masaryk University in Brno, Czech Republic, protecting the university's network and serving as the operational and research backbone for cybersecurity across 26 Czech public universities.

Ownership category

akta.pro rank

Product category

Cybersecurity Incident Response

NAICS

Investigation and Security Services (5616), Security Systems Services (except Locksmiths) (561621)

SIC

Services-Educational Services (8200)

akta.pro primary industry

Vulnerability Management & Penetration Testing Services (BPAEADAD)

akta.pro secondary industries

Cybersecurity (EDAAAPAC), Penetration Testing, Red Team & Ethical Hacking (EDAOAIAH), Cybersecurity Technical Skills (Security Engineering, SOC, Pen Testing) (EDABAFAF), Cybersecurity (Digital Safety, Ethical Hacking Basics) (EDAMACAH)

Keywords

• Incident response services
• Cybersecurity research
• Security telemetry analysis
• Penetration testing
• Threat intelligence

Headquarters

HQ city

Brno

HQ country

Czechia

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Infrastructure, Marketing or Sales

Revenue model

1. University Core Funding: Core operational funding from Masaryk University through the Institute of Computer Science to provide cybersecurity services to the university community
2. Research Grants: Funding from Czech government agencies (Ministry of Interior, Technology Agency of Czech Republic, Ministry of Education) and European Union programs (Horizon Europe, Digital Europe, Horizon 2020) for cybersecurity research projects

Go-to-market motion1 record

Distribution channels3 records

Marketing channels7 records

Core offering

CSIRT-MU provides cybersecurity incident handling, continuous threat monitoring and warnings, penetration testing, and security awareness training for the Masaryk University community, delivered free of charge to students, faculty, and staff. Beyond operations, the team runs an applied research program developing open-source tools and platforms (such as KYPO Cyber Polygon and Stream4Flow) and coordinates Czech academic-sector cybersecurity capacity through 26-university CRP-Kyber projects and EU-funded research programs.

Product overview

CSIRT-MU is the Computer Security Incident Response Team of Masaryk University, providing a comprehensive portfolio of cybersecurity services including incident handling, security warnings, penetration testing, and user/IT administrator education. Their research projects (Andromeda, AICA-CONNECT, SOCCER, ResilMesh, SECURIAN) develop AI-powered tools for automated security telemetry analysis, autonomous cybersecurity systems, and SOC capabilities. The team also maintains open-source platforms like KYPO Cyber Polygon for security training and Stream4Flow for real-time network analysis.

Differentiator

Problem solved

Functional benefit

Products and services

• Incident Handling Handling and coordination of security incidents within Masaryk University's network infrastructure, including DoS attacks, password breaches, port scanning, phishing, and email scams, delivered to students, faculty, and staff of Masaryk University.
• Security Warnings and Information Continuous monitoring of cyber-security threats and publication of warnings and informational alerts containing basic recommendations for risk reduction, distributed to the Masaryk University community.
• Penetration Testing Testing services to detect vulnerable components, outdated software, and possible attack vectors in selected Masaryk University services, with reports evaluating cybersecurity aspects and improvement recommendations.
• User Education and Training Training on cybersecurity basics for users within the Masaryk University constituency, teaching active prevention of common threats in day-to-day work, including advice on secure IT and internet use, delivered through the security.muni.cz education platform.
• IT Administrators Education Education for IT administrators on preventing and processing security incidents, along with basic security advice, provided within the Masaryk University IT operations environment.
• KYPO Cyber Polygon Open-source virtual environment for research and development of methods for protection against attacks on critical information structures, providing flexible, scalable, and resource-efficient security training and exercises for cybersecurity teams.
• Stream4Flow Open-source real-time network data analysis tool utilizing distributed stream processing of large data volumes, visualization, and network traffic monitoring for cybersecurity operations teams.

Quantifiable outcome

• Successfully protecting Masaryk University network since 2009 with majority of incidents resolved automatically since 2011
• +3 more outcomes

Named customers2 records

Segments2 records

Ideal customer profiles2 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability6 records

Feature4 records

Partnerships

Eight partnerships are on record, tiered core and major.

• CESNETcoreStrategic or Co-development PartnerLong-term partnership with CESNET, the Czech national research and education network. CSIRT-MU cooperates with CESNET on threat sharing, log management, and security information exchange. Joint projects include WARDEN (threat exchange system), SABU (security event sharing), and CESNET Development Fund projects.
• National Cyber and Information Security Agency (NUKIB)coreStrategic or Co-development PartnerCooperation with the Czech national cybersecurity authority on threat intelligence, incident coordination, and national cybersecurity capacity building. CSIRT-MU participates in joint exercises and coordinates on incident response.
• Faculty of Informatics, Masaryk UniversitycoreStrategic or Co-development PartnerClose collaboration with the Faculty of Informatics for education, research, and talent development. Team members teach courses and supervise theses. Joint establishment of KYPOLAB for practical cybersecurity training.
• FlowMon NetworksmajorStrategic or Co-development PartnerCollaboration with FlowMon Networks on network monitoring and security analytics. Joint projects include MACE (intelligent sensors for cloud environment analysis) and SECURIAN (cybersecurity incident analysis tools). FlowMon products implement research outputs.
• GÉANTmajorStrategic or Co-development PartnerPartnership through the European research network GÉANT for cybersecurity collaboration across European academic networks and participation in pan-European security initiatives.
• JOANNEUM RESEARCHmajorStrategic or Co-development PartnerResearch partner in the ResilMesh Horizon Europe project focused on cyber situational awareness and security orchestration for dispersed critical infrastructure.
• University of MurciamajorStrategic or Co-development PartnerResearch partner in the ResilMesh Horizon Europe project for cyber resilience and situational awareness in heterogeneous cyber systems.
• Trusted IntroducercoreStrategic or Co-development PartnerEuropean organization bringing together national, academic, and commercial computer security teams. CSIRT-MU was registered in 2009, accredited in 2011, and certified in 2016 as first team in Czech Republic.

Scale indicators5 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• SURFcert: The Dutch academic CERT serving all SURF-member universities and research institutions in the Netherlands. Direct peer to CSIRT-MU as a national academic CERT providing incident response, threat intelligence, and security coordination across a country's higher-education sector.
• REN-CERT (FCCN): Portuguese academic CERT operated by FCCN providing cybersecurity services to the Portuguese research and education network. Direct peer as a national academic CERT in a smaller EU country with similar constituency model.
• SWITCH-CERT: Swiss academic CERT serving Swiss universities and research institutions through the SWITCH network. Direct peer in academic cybersecurity coordination, with similar Trusted Introducer status and comparable scale to CSIRT-MU.
• DFN-CERT: Germany's academic CERT operated by the DFN (Deutsches Forschungsnetz) association, providing security services to over 100 German universities and research institutions. Closest large-scale peer to CSIRT-MU in terms of constituency type, mission, and operational scope.
• JISC CSIRT: UK academic cybersecurity team serving JISC-member universities and colleges. Comparable in mandate (academic sector cybersecurity), governance structure, and operational scope to CSIRT-MU.
• UNINETT CERT (Sikt): Norwegian academic CERT, now part of Sikt, providing security services to Norwegian universities and research institutions. Comparable academic CERT operating in a Nordic EU/EEA country with similar Trusted Introducer status.

Others

• CESNET: Czech national research and education network operator with its own security team. CSIRT-MU has a long-term strategic partnership with CESNET for threat sharing, log management, and joint projects (WARDEN, SABU). Closest domestic peer from a collaboration/cooperation standpoint rather than competitive.
• ENISA: EU Agency for Cybersecurity responsible for NIS2 implementation support and pan-European cyber capacity building. CSIRT-MU cooperates with ENISA through Trusted Introducer and TF-CSIRT, and ENISA shapes the regulatory environment in which CSIRT-MU operates.
• GÉANT: European research and education networking consortium connecting Europe's NRENs and providing pan-European cybersecurity services (including the GÉANT CSIRT function). CSIRT-MU is a cooperation partner of GÉANT, making it an ecosystem-level comparable rather than direct competitor.

Broad incumbents

• CERT/CC (Carnegie Mellon): The original CERT Coordination Center established at Carnegie Mellon, the foundational academic CERT that pioneered the CSIRT model. Broad incumbent in academic cybersecurity with deeper resources, broader scope, and applied R&D that influenced the entire field including CSIRT-MU's approach.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/csirtmu
• GitHubgithub.com/csirt-mu
• Facebookfacebook.com/csirtmu
• LinkedInlinkedin.com/company/csirt-mu
• Instagraminstagram.com/muni_kybertym

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Profiles8 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about CSIRT-MU