INCYDE
INCYDE industrial cyber defense GmbH is a Berlin-headquartered, founder-owned German cybersecurity consulting firm delivering IT/OT security services and proprietary testing platforms to railway, automotive, industry, maritime, and energy clients across Germany and Austria.
- Company typePrivate
- Founded2020
- HeadquartersBerlin, Germany
- Headcount11–50
- GTM typeB2B
- OfferingServices
What INCYDE does
INCYDE industrial cyber defense GmbH is a privately held, Berlin-headquartered cybersecurity consulting firm specializing in IT/OT security for industrial control systems. The company serves market-leading clients in the Railway, Automotive, Industry, Maritime, and Energy sectors across Germany and Austria, with offices in Berlin, Frankfurt, Munich, Leipzig, Darmstadt, and Vienna. Its service portfolio is structured across four lifecycle pillars — Design (security research, concepts, threat & risk analysis, requirements engineering), Implementation (systems engineering, SecOps/DevOps, security testbed), Verification (security testing, penetration testing, verification & validation, appraisal), and Management & Training — with project-based, quote-driven engagements as the dominant revenue model.
The firm's technical stack includes the proprietary INCYDE Cyber Security Platform for automated EULYNX security interface testing (containing a full PKI and NTS server), a modular industrial PKI platform deployed in Deutsche Bahn's Digitaler Knoten Stuttgart project, and the MIT-licensed open-source AttackGraph-Tool for graph-based threat modeling. INCYDE operates as a standards shaper within the European rail ecosystem, leading the EULYNX Security Cluster, managing the ERTMS Users Group Security Core Group, and representing DB Netz AG in the OCORA Security Workstream. Certifications include ISO 27001, ISO 9001, and TISAX (2022).
The company is founder-owned and managed by Max Schubert (Managing Director), Prof. Stefan Katzenbeisser (University of Passau), and Prof. Christoph Krauß (Hochschule Darmstadt), combining commercial delivery with academic research partnerships. Revenue derives primarily from professional services across the full project lifecycle, supplemented by government-funded applied research (DZSF, BMBF). No external institutional investment, M&A activity, or public revenue disclosure is recorded in the source materials.
INCYDE firmographics
Firmographics- Name
- INCYDE
- Legal name
- INCYDE industrial cyber defense GmbH
- Website
- https://incyde.com
- Company type
- Private
- Founded year
- 2020
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- INCYDE industrial cyber defense GmbH is a Berlin-headquartered, founder-owned German cybersecurity consulting firm delivering IT/OT security services and proprietary testing platforms to railway, automotive, industry, maritime, and energy clients across Germany and Austria.
- Ownership category
- akta.pro rank
INCYDE industry classification
Industry- Product category
- Industrial Cybersecurity Consulting
- NAICS
- Computer Systems Design and Related Services (5415), Computer Systems Design Services (541512), Management, Scientific, and Technical Consulting Services (5416), Other Scientific and Technical Consulting Services (54169), Custom Computer Programming Services (541511)
- SIC
- Services-Computer Integrated Systems Design (7373), Services-Computer Programming Services (7371)
- akta.pro primary industry
- Cybersecurity Architecture & Security Integration (BPAEAAAL)
- akta.pro secondary industries
- IT Governance, Risk & Compliance (IT GRC) Platforms (HDAEALAK), Threat Intelligence Services (BPAEADAC), Policy Management, Training & Ethics/Whistleblowing (BPAEAPAI)
Keywords
Where INCYDE is headquartered
LocationHeadquarters
- HQ city
- Berlin
- HQ country
- Germany
- HQ region
- Europe
Offices6 records
Markets served
INCYDE business model
Business model- GTM type
- B2B
- Offering type
- Services
- Cost components
- Personnel, Technology or R&D, Operations, Marketing or Sales
Revenue model
- Cybersecurity Consulting Services: Professional services revenue generated through consulting engagements, security assessments, penetration testing, training, and project-based cybersecurity services across the full project lifecycle from design through implementation and verification.
- Research and Development Services: Applied cybersecurity research projects funded by government agencies (DZSF, BMBF) and industry consortiums, contributing to standards development and specialized security solutions.
Go-to-market motion1 record
Distribution channels1 record
Marketing channels5 records
INCYDE product offering
Product offeringCore offering
INCYDE delivers specialized cybersecurity consulting and engineering services for industrial IT/OT environments across the railway, automotive, energy, industrial, and maritime sectors. Its offering is structured around four service pillars — Design (Security Research, Concepts, Threat & Risk Analysis, Requirements Engineering), Implementation (Systems Engineering, SecOps/DevOps, Security Testbed), Verification (Security Testing, Penetration Testing, V&V, Appraisal) and Management & Training — complemented by proprietary tools such as the INCYDE Cyber Security Platform, the open-source AttackGraph-Tool, and a modular PKI platform.
Product overview
INCYDE (Industrial Cyber Defense) is a cybersecurity services company offering a portfolio of professional services across five industry verticals (Railway, Automotive, Industry, Maritime, Energy). The core offering is structured around four service pillars: Design (Security Research, Concepts, Threat & Risk Analysis, Requirements Engineering), Implementation (Systems Engineering, SecOps/DevOps, Security Testbed), Verification (Security Testing, Pentesting, V&V, Appraisal), and Management & Training. The company also provides a proprietary Cyber Security Platform for automated EULYNX security interface testing, includes an open-source AttackGraph-Tool for visual threat analysis, and operates a modular PKI platform for industrial use.
Differentiator
Problem solved
Functional benefit
Brands
- INCYDE Cyber Security Platform: Automated testing platform for EULYNX security interfaces, containing a fully functional PKI and NTS server.
Products and services
- Design Services
Quantifiable outcome
- 300 digital certificates created for ATO components in Digitaler Knoten Stuttgart project
- +1 more outcomes
Companies that use INCYDE
Customer profileNamed customers8 records
Segments5 records
Ideal customer profiles5 records
INCYDE technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
AI capability4 records
Feature3 records
INCYDE partnerships and signals
Strategic signalPartnerships
17 partnerships are on record, tiered minor and core.
- IrdetominorPartnership with Irdeto and Utimaco for whitepaper on holistic EV charging infrastructure security, defining the future of the EV ecosystem.
- UtimacominorPartnership with Irdeto and INCYDE for whitepaper on holistic EV charging infrastructure security.
- Irdeto INCHARGE EV Charging Infrastructure SymposiumminorProf. Krauß presented at Irdeto's INCHARGE symposium on security and privacy challenges in ISO 15118.
- DZSF (German Centre for Rail Transport Research)coreResearch partnership for technology forecasting and security concept evaluation funded by DZSF. Project partners include Fraunhofer SIT, University of Passau, and Nextrail.
- Fraunhofer SITcoreResearch partner in DZSF-funded technology forecasting project for rail transport security requirements and evaluation of future OT security concepts.
- EULYNXcoreINCYDE leads EULYNX Security Cluster responsible for developing OT security requirements for European digital interlocking standards (Baseline 4 Release 1).
- ERTMS Users Group (EUG)coreINCYDE provides organizational and technical management for EUG Security Core Group (ESCG), analyzing threats and risks for ERTMS and developing security measures for European train control systems.
- University of PassaucoreAcademic partnership with Prof. Stefan Katzenbeisser (Professor of Computer Engineering, research focus on cybersecurity and critical infrastructures) leading Railway Security Research at INCYDE.
- Hochschule Darmstadt (University of Applied Sciences)coreAcademic partnership with Prof. Christoph Krauß (Professor of Network Security, Head of Applied Cyber Security Darmstadt) leading Automotive Security Research at INCYDE. Also cooperation partner for dual study programs in IT Security.
- NextrailcoreRailway industry competency partner for joint projects including DZSF research, OCORA security workstream, and technology forecasting.
- CYSIS (TU Darmstadt & DB Netz AG Innovation Alliance)minorCYBERSECURITY working group within the TU Darmstadt and DB Netz AG innovation alliance. Jointly developed IoRT Security whitepaper with CISCO, Fraunhofer SIT, ÖBB, and INCYDE.
- OCORA (DB, SNCF, NS, ÖBB, SBB consortium)coreINCYDE represents DB Netz AG in OCORA Security Workstream, developing cybersecurity requirements for European train system standardization.
- FOS4R (Fibre Optic Sensing for Railways)minorINCYDE works with FOS4R to implement security-by-design principles for protecting sensitive Fibre Optic Sensing data.
- DQS (Deutsche Gesellschaft zur Zertifizierung von Managementsystemen)minorThird-party certification body that conducted ISO 27001 and ISO 9001 audits for INCYDE.
- ENXminorENX portal provides access to TISAX assessment results for automotive security information protection.
- CISCOminorProject partner in CYSIS working group for IoRT Security whitepaper development.
- ÖBB (Austrian Federal Railways)minorProject partner in CYSIS working group for IoRT Security whitepaper development.
Scale indicators3 records
Recent moves6 records
Expansion highlights5 records
INCYDE competitors and assessment
Company assessmentDirect peers
- Claroty: Industrial/OT cybersecurity firm offering asset discovery, threat detection, and vulnerability management for critical infrastructure, manufacturing, and rail environments. Directly comparable as a specialist IT/OT cybersecurity provider targeting the same industrial verticals.
- Nozomi Networks: OT and IoT security vendor providing network visibility, threat detection, and asset monitoring for industrial, energy, and transportation sectors. Comparable as an OT cybersecurity specialist serving overlapping industrial customer segments.
- Forescout: Cybersecurity firm specializing in OT/ICS visibility, network access control, and industrial cybersecurity across critical infrastructure. Comparable as a specialist provider of IT/OT security solutions for industrial operators.
- ERNW Research: Germany-based independent IT security consultancy offering penetration testing, security assessments, and research-grade expertise across enterprise and industrial clients. Directly comparable as a DACH-rooted specialist cybersecurity consulting firm.
- Kaspersky Industrial CyberSecurity: Industrial cybersecurity division providing specialized OT/ICS threat detection, incident response, and vulnerability assessment for industrial operators. Comparable as a specialist IT/OT cybersecurity provider addressing industrial threat analysis and security testing.
Broad incumbents
- NCC Group: Global cybersecurity consulting firm providing penetration testing, red teaming, and security advisory across critical infrastructure, industrial, and transport clients. Comparable as a broad incumbent cybersecurity consultancy serving regulated industrial customers.
- Mandiant (Google Cloud): Global cybersecurity consulting firm specializing in incident response, threat intelligence, and security assessments for enterprise and industrial clients. Comparable as a broad incumbent offering similar cybersecurity advisory and testing services.
- TÜV Rheinland: International testing and certification organization providing cybersecurity assessments, industrial system certification, and conformity services for rail, automotive, and industrial sectors. Comparable as a broad incumbent with overlapping IT/OT security assurance offerings.
- TÜV SÜD: Global testing, inspection, and certification body with industrial cybersecurity services spanning rail, automotive, energy, and industrial verticals. Comparable as a broad incumbent offering overlapping IT/OT security assessment and certification services.
Emerging players
- Oneconsult: Swiss-based boutique cybersecurity consultancy offering penetration testing, red teaming, and security assessments for enterprise clients in DACH and beyond. Comparable as a smaller specialist cybersecurity consulting peer operating in overlapping European geographies.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat4 records
Key risks6 records
Key highlights7 records
Customer concentration
INCYDE social profiles
Digital presenceINCYDE compliance and trust
Trust signalCompliance3 records
INCYDE financial estimates
Financial estimateRevenue estimate
Valuation estimate
INCYDE leadership team
Management profileNumber of profiles
Profiles6 records
INCYDE funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
INCYDE M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about INCYDE
What does INCYDE do?
INCYDE delivers specialized cybersecurity consulting and engineering services for industrial IT/OT environments across the railway, automotive, energy, industrial, and maritime sectors. Its offering is structured around four service pillars — Design (Security Research, Concepts, Threat & Risk Analysis, Requirements Engineering), Implementation (Systems Engineering, SecOps/DevOps, Security Testbed), Verification (Security Testing, Penetration Testing, V&V, Appraisal) and Management & Training — complemented by proprietary tools such as the INCYDE Cyber Security Platform, the open-source AttackGraph-Tool, and a modular PKI platform.
Is INCYDE a public or private company?
INCYDE is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was INCYDE founded?
INCYDE was founded in 2020. It employs 11 to 50 people.
Where is INCYDE based?
INCYDE is headquartered in Berlin, Germany, in the Europe region.
How does INCYDE make money?
Two revenue lines are on record. Cybersecurity Consulting Services are the primary driver. The others are research and Development Services.
Who are INCYDE's main competitors?
Direct peers on record are Claroty, Nozomi Networks, Forescout, ERNW Research and Kaspersky Industrial CyberSecurity. Broad incumbents are NCC Group, Mandiant (Google Cloud), TÜV Rheinland and TÜV SÜD. Oneconsult is listed as an emerging player.
Does INCYDE have an API?
No public API is recorded for INCYDE.
What industry is INCYDE in?
INCYDE's product category is Industrial Cybersecurity Consulting. Its primary akta.pro industry code is BPAEAAAL, Cybersecurity Architecture & Security Integration, with a secondary code of HDAEALAK, IT Governance, Risk & Compliance (IT GRC) Platforms. Its NAICS code is 5415 and its SIC code is 7373.