What @-yet does

@-yet GmbH is a privately-held German cybersecurity consulting firm founded in 2002 and headquartered at Schloss Eicherhof in Leichlingen, between Cologne and Düsseldorf. The company operates as an independent, vendor-neutral advisor, with a stated policy of never selling hardware or software, and is owned and led by the Sträufer family: Wolfgang Sträufer (Managing Director, Strategy), Florian Sträufer (IT Security), and Lucia Sträufer (Data Protection). The firm employs more than 90 people, of whom more than 40 are described as security experts with experience from hundreds of incidents, and serves medium-to-large enterprises, critical infrastructure operators (KRITIS), and organizations adopting AI across the DACH region.

The service portfolio is organized around three core practice areas — IT Security, Incident Response, and Compliance/Data Protection — and includes application security (DevSecOps audit, secure code review, threat modeling, mobile and web application security), cloud security (C5 assessment, cloud penetration testing, external cloud security architect), AI services (AI security testing, AI compliance, AI training, AI quick check), secure infrastructure (SOC/SIEM, threat hunting), penetration testing, red teaming, business continuity management, and regulatory compliance work spanning GDPR, NIS2, DORA, ISMS, and whistleblower protection. The Incident Response practice covers ransomware emergency assistance, DFIR framework contracts, general IT emergency help, and recovery (Wiederanlauf). Credibility is anchored in four BSI certifications — ISO 27001 on IT-Grundschutz, APT Response Dienstleister, IT-Sicherheitsdienstleister for incident handling, and IT-Sicherheitsdienstleister for penetration testing — plus DMSZ certification to ISO/IEC 27001:2022.

The business model is professional services: engagements are quote-based, with retainer arrangements available for incident response via DFIR framework contracts. Distribution is direct, via website contact forms, phone (+49 2175 16 55 0), and email, with no channel or reseller partners. Marketing is centered on thought leadership through the R(h)eingehäckt cybersecurity podcast, a technical blog covering EU regulations and AI security, on-site and remote training and seminars (including EU AI Regulation-mandated training), and webinars such as the R(h)eingezappt series. The firm is a member of multiple German industry associations (Allianz für Cybersicherheit, ASW West, BvD, eco, TeleTrust, GDD, BVMW, EuroCloud Deutschland) and holds an academic partnership with Rheinische Fachhochschule Köln.

Name

@-yet

Legal name

@-yet GmbH

Website

https://at-yet.de

Company type

Private

Founded year

2002

Operating status

Operating

Headcount range

51–100 employees

Short description

@-yet GmbH is a privately-held German cybersecurity consulting firm founded in 2002, providing BSI-certified IT security, incident response, and compliance services to medium and large enterprises and critical infrastructure operators across the DACH region.

Ownership category

akta.pro rank

Product category

Cybersecurity Consulting

NAICS

Computer Systems Design and Related Services (54151), Management Consulting Services (54161)

SIC

Services-Computer Programming, Data Processing, Etc. (7370), Services-Computer Programming Services (7371)

akta.pro primary industry

Cybersecurity & Identity Consulting (BPAHAEAG)

akta.pro secondary industries

Data Security & Privacy Managed Services (DLP/Encryption) (BPAEADAL), Managed Detection & Response (MDR) & SOC Services (HDADAGAG), Backup & DR Software Implementation & Managed Platforms (BPAEALAI), Application Security & Secure Software (DevSecOps) (EDAOAIAK)

Keywords

• Cybersecurity consulting services
• Incident response support
• Penetration testing services
• Data protection compliance
• NIS2 DORA consulting

Headquarters

HQ city

Leichlingen

HQ country

Germany

HQ region

Europe

Offices2 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Others

Revenue model

1. Cybersecurity Consulting Services: Professional consulting services for IT security, including penetration testing, security assessments, cloud security, and AI security testing. Billed on project basis or through retainer arrangements.
2. Incident Response Services: Emergency IT assistance including ransomware emergency help, IT emergency response, and recovery/wiederanlauf services. Provided through DFIR framework contract or on-demand.
3. Training and Seminars: AI training courses, skills training, management training, and awareness programs. Formats include on-site and remote delivery, ranging from 30-minute sessions to 1.5-day workshops.
4. Compliance Advisory: Data protection officer services, NIS2 implementation consulting, DORA compliance, ISMS implementation, and whistleblower protection system setup and operation.

Go-to-market motion1 record

Distribution channels2 records

Marketing channels5 records

Core offering

@-yet is an independent cybersecurity consulting firm delivering proactive IT security services (penetration testing, cloud security, application security, AI security testing, red teaming), emergency incident response (DFIR framework, ransomware emergency help), and regulatory compliance advisory (GDPR, NIS2, DORA, ISMS, whistleblower protection). Services are delivered as professional consulting engagements on a project or retainer basis by a team of more than 90 BSI-certified experts.

Product overview

@-yet is a cybersecurity services company offering a comprehensive portfolio organized around three core service areas: IT Security, Incident Response, and Compliance/Data Protection. The company provides services across multiple specialized modules including Application Security (DevSecOps Audit, Secure Code Review, Penetration Testing), Cloud Security (C5 Assessment, Cloud Penetration Testing), AI Security and Consulting (AI Security Testing, AI Compliance, AI Training, AI Quick Check), Secure Infrastructure (SOC/SIEM, Threat Hunting), Red Teaming, Business Continuity Management, and ISMS implementation. The Compliance practice covers GDPR/data protection, NIS2, DORA, and Whistleblower Protection. Training services include cybersecurity awareness, management training, and specialized AI skills courses. The company also produces the R(h)eingezappt cybersecurity podcast. All services are delivered with independence from hardware/software manufacturers, ensuring vendor-neutral advice.

Differentiator

Problem solved

Functional benefit

Products and services

• IT Security Services Proactive IT security services including application security, cloud security, AI security, penetration testing, red teaming, and secure infrastructure management, delivered for mid-market and enterprise organizations across the DACH region.
• Incident Response Services Rapid emergency response services for cyber incidents including ransomware emergency assistance, DFIR framework contracts, IT emergency assistance, and recovery/Wiederanlauf operations, delivered by BSI-certified APT Response specialists.
• Compliance and Data Protection Services Regulatory compliance services covering GDPR/data protection, NIS2, DORA, ISMS implementation, and whistleblower protection for organizations subject to EU regulatory requirements.
• Penetration Testing Services

Quantifiable outcome

• More than 90 employees and experience from hundreds of security incidents

Segments3 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability9 records

Feature3 records

Partnerships

Eleven partnerships are on record, tiered minor.

• IONOS SEminorOthersIONOS SE is the external hosting provider for @-yet's website and online services. The hosting service is used for the purpose of fulfilling contracts with potential and existing customers and in the interest of secure, fast, and efficient online service provision.
• Allianz für CybersicherheitminorOthersIndustry association membership supporting cybersecurity awareness and collaboration in Germany.
• ASW WestminorOthersIndustry association membership for corporate security professionals in the West Germany region.
• BvD e.V. (Berufsverband der Datenschutzbeauftragten)minorOthersProfessional association membership for data protection officers, supporting data privacy professionals in Germany.
• eco (Verband der Internetwirtschaft)minorOthersAssociation of the Internet industry in Germany, promoting digital economy and cybersecurity.
• TeleTrustminorOthersGerman IT security association promoting trusted IT solutions and cybersecurity standards.
• GDD (Gesellschaft für Datenschutz und Datensicherung)minorOthersSociety for data protection and data security, supporting privacy compliance professionals.
• BVMW (Bundesverband der Mittelständischen Wirtschaft)minorOthersNational association representing medium-sized businesses, supporting SME digitalization and cybersecurity.
• Deutsch-Israelische WirtschaftsvereinigungminorOthersGerman-Israeli economic association facilitating business relationships between the two countries.
• EuroCloud DeutschlandminorOthersEuropean cloud computing association with German chapter, promoting cloud security and standards.
• Rheinische Fachhochschule KölnminorOthersAcademic institution partnership for education and knowledge exchange in IT security.

Scale indicators5 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• SySS GmbH: SySS is a German cybersecurity firm specializing in penetration testing, red teaming, and incident response with a similar vendor-neutral, expert-driven model. Direct overlap with @-yet's core pen-testing, red teaming, and DFIR practices.
• cirosec GmbH: cirosec is a German cybersecurity consultancy focused on penetration testing, incident response, and security audits. Comparable mid-sized German competitor with similar vendor-neutral consulting positioning and BSI-relevant expertise.
• iteratec GmbH: iteratec is a German software and security consultancy offering application security, penetration testing, and DevSecOps services. Comparable headcount and direct overlap in application security, cloud security, and DevSecOps audit practices.
• HvS-Consulting AG: HvS-Consulting is a German cybersecurity and IT compliance consultancy providing penetration testing, ISMS, and security awareness services. Direct competitor in the same DACH mid-market with similar BSI-aligned compliance offerings.

Broad incumbents

• Orange Cyberdefense: Orange Cyberdefense is a global MSSP with strong German presence offering managed detection, incident response, and consulting. Overlaps with @-yet's SOC/SIEM, threat hunting, and DFIR practices but at a much larger scale with broader geographic footprint.
• Trustwave: Trustwave is a global cybersecurity firm offering managed security services, incident response, and penetration testing. Overlaps with @-yet's incident response and consulting practices but operates at a larger scale with global delivery.
• secunet Security Networks AG: secunet is a German publicly-listed cybersecurity incumbent serving federal, defense, and critical infrastructure clients with a broad portfolio including SINA, consulting, and managed services. Overlaps with @-yet's BSI-certified practice and KRITIS focus but operates at a much larger scale.
• NCC Group: NCC Group is a UK-headquartered global cybersecurity consultancy with strong German footprint via the former Fox-IT and ESC brand, offering penetration testing, incident response, and compliance. Comparable in DFIR and pen-testing capabilities but at global scale.
• TÜV TRUST IT / TÜV AUSTRIA Group: TÜV TRUST IT is a German-based IT security and compliance consultancy offering ISO 27001, ISMS, and penetration testing services. Comparable in compliance and ISMS implementation services targeting KRITIS and regulated enterprises.
• SEC Consult (Atos Group): SEC Consult is a European cybersecurity consultancy (now part of Atos) specializing in penetration testing, incident response, and security consulting. Direct overlap in pen-testing and DFIR services with German-speaking market presence.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks5 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/at-yet

Compliance5 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about @-yet