INCYDE

What INCYDE does

INCYDE industrial cyber defense GmbH is a privately held, Berlin-headquartered cybersecurity consulting firm specializing in IT/OT security for industrial control systems. The company serves market-leading clients in the Railway, Automotive, Industry, Maritime, and Energy sectors across Germany and Austria, with offices in Berlin, Frankfurt, Munich, Leipzig, Darmstadt, and Vienna. Its service portfolio is structured across four lifecycle pillars — Design (security research, concepts, threat & risk analysis, requirements engineering), Implementation (systems engineering, SecOps/DevOps, security testbed), Verification (security testing, penetration testing, verification & validation, appraisal), and Management & Training — with project-based, quote-driven engagements as the dominant revenue model.

The firm's technical stack includes the proprietary INCYDE Cyber Security Platform for automated EULYNX security interface testing (containing a full PKI and NTS server), a modular industrial PKI platform deployed in Deutsche Bahn's Digitaler Knoten Stuttgart project, and the MIT-licensed open-source AttackGraph-Tool for graph-based threat modeling. INCYDE operates as a standards shaper within the European rail ecosystem, leading the EULYNX Security Cluster, managing the ERTMS Users Group Security Core Group, and representing DB Netz AG in the OCORA Security Workstream. Certifications include ISO 27001, ISO 9001, and TISAX (2022).

The company is founder-owned and managed by Max Schubert (Managing Director), Prof. Stefan Katzenbeisser (University of Passau), and Prof. Christoph Krauß (Hochschule Darmstadt), combining commercial delivery with academic research partnerships. Revenue derives primarily from professional services across the full project lifecycle, supplemented by government-funded applied research (DZSF, BMBF). No external institutional investment, M&A activity, or public revenue disclosure is recorded in the source materials.

Name

INCYDE

Legal name

INCYDE industrial cyber defense GmbH

Website

https://incyde.com

Company type

Private

Founded year

2020

Operating status

Operating

Headcount range

11–50 employees

Short description

INCYDE industrial cyber defense GmbH is a Berlin-headquartered, founder-owned German cybersecurity consulting firm delivering IT/OT security services and proprietary testing platforms to railway, automotive, industry, maritime, and energy clients across Germany and Austria.

Ownership category

akta.pro rank

Product category

Industrial Cybersecurity Consulting

NAICS

Computer Systems Design and Related Services (5415), Computer Systems Design Services (541512), Management, Scientific, and Technical Consulting Services (5416), Other Scientific and Technical Consulting Services (54169), Custom Computer Programming Services (541511)

SIC

Services-Computer Integrated Systems Design (7373), Services-Computer Programming Services (7371)

akta.pro primary industry

Cybersecurity Architecture & Security Integration (BPAEAAAL)

akta.pro secondary industries

IT Governance, Risk & Compliance (IT GRC) Platforms (HDAEALAK), Threat Intelligence Services (BPAEADAC), Policy Management, Training & Ethics/Whistleblowing (BPAEAPAI)

Keywords

• Industrial cybersecurity
• IT/OT security
• Cybersecurity consulting
• Railway cybersecurity
• Automotive cybersecurity

Headquarters

HQ city

Berlin

HQ country

Germany

HQ region

Europe

Offices6 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales

Revenue model

1. Cybersecurity Consulting Services: Professional services revenue generated through consulting engagements, security assessments, penetration testing, training, and project-based cybersecurity services across the full project lifecycle from design through implementation and verification.
2. Research and Development Services: Applied cybersecurity research projects funded by government agencies (DZSF, BMBF) and industry consortiums, contributing to standards development and specialized security solutions.

Go-to-market motion1 record

Distribution channels1 record

Marketing channels5 records

Core offering

INCYDE delivers specialized cybersecurity consulting and engineering services for industrial IT/OT environments across the railway, automotive, energy, industrial, and maritime sectors. Its offering is structured around four service pillars — Design (Security Research, Concepts, Threat & Risk Analysis, Requirements Engineering), Implementation (Systems Engineering, SecOps/DevOps, Security Testbed), Verification (Security Testing, Penetration Testing, V&V, Appraisal) and Management & Training — complemented by proprietary tools such as the INCYDE Cyber Security Platform, the open-source AttackGraph-Tool, and a modular PKI platform.

Product overview

INCYDE (Industrial Cyber Defense) is a cybersecurity services company offering a portfolio of professional services across five industry verticals (Railway, Automotive, Industry, Maritime, Energy). The core offering is structured around four service pillars: Design (Security Research, Concepts, Threat & Risk Analysis, Requirements Engineering), Implementation (Systems Engineering, SecOps/DevOps, Security Testbed), Verification (Security Testing, Pentesting, V&V, Appraisal), and Management & Training. The company also provides a proprietary Cyber Security Platform for automated EULYNX security interface testing, includes an open-source AttackGraph-Tool for visual threat analysis, and operates a modular PKI platform for industrial use.

Differentiator

Problem solved

Functional benefit

Brands

• INCYDE Cyber Security Platform: Automated testing platform for EULYNX security interfaces, containing a fully functional PKI and NTS server.

Products and services

• Design Services

Quantifiable outcome

• 300 digital certificates created for ATO components in Digitaler Knoten Stuttgart project
• +1 more outcomes

Named customers8 records

Segments5 records

Ideal customer profiles5 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability4 records

Feature3 records

Partnerships

17 partnerships are on record, tiered minor and core.

• IrdetominorStrategic or Co-development Partner · 1 January 2023Partnership with Irdeto and Utimaco for whitepaper on holistic EV charging infrastructure security, defining the future of the EV ecosystem.
• UtimacominorStrategic or Co-development Partner · 1 January 2023Partnership with Irdeto and INCYDE for whitepaper on holistic EV charging infrastructure security.
• Irdeto INCHARGE EV Charging Infrastructure SymposiumminorGTM or Marketing Partner · 1 January 2023Prof. Krauß presented at Irdeto's INCHARGE symposium on security and privacy challenges in ISO 15118.
• DZSF (German Centre for Rail Transport Research)coreStrategic or Co-development Partner · 1 January 2022Research partnership for technology forecasting and security concept evaluation funded by DZSF. Project partners include Fraunhofer SIT, University of Passau, and Nextrail.
• Fraunhofer SITcoreStrategic or Co-development Partner · 1 January 2022Research partner in DZSF-funded technology forecasting project for rail transport security requirements and evaluation of future OT security concepts.
• EULYNXcoreStrategic or Co-development Partner · 1 January 2022INCYDE leads EULYNX Security Cluster responsible for developing OT security requirements for European digital interlocking standards (Baseline 4 Release 1).
• ERTMS Users Group (EUG)coreStrategic or Co-development Partner · 1 January 2022INCYDE provides organizational and technical management for EUG Security Core Group (ESCG), analyzing threats and risks for ERTMS and developing security measures for European train control systems.
• University of PassaucoreStrategic or Co-development PartnerAcademic partnership with Prof. Stefan Katzenbeisser (Professor of Computer Engineering, research focus on cybersecurity and critical infrastructures) leading Railway Security Research at INCYDE.
• Hochschule Darmstadt (University of Applied Sciences)coreStrategic or Co-development PartnerAcademic partnership with Prof. Christoph Krauß (Professor of Network Security, Head of Applied Cyber Security Darmstadt) leading Automotive Security Research at INCYDE. Also cooperation partner for dual study programs in IT Security.
• NextrailcoreStrategic or Co-development PartnerRailway industry competency partner for joint projects including DZSF research, OCORA security workstream, and technology forecasting.
• CYSIS (TU Darmstadt & DB Netz AG Innovation Alliance)minorStrategic or Co-development PartnerCYBERSECURITY working group within the TU Darmstadt and DB Netz AG innovation alliance. Jointly developed IoRT Security whitepaper with CISCO, Fraunhofer SIT, ÖBB, and INCYDE.
• OCORA (DB, SNCF, NS, ÖBB, SBB consortium)coreStrategic or Co-development PartnerINCYDE represents DB Netz AG in OCORA Security Workstream, developing cybersecurity requirements for European train system standardization.
• FOS4R (Fibre Optic Sensing for Railways)minorStrategic or Co-development PartnerINCYDE works with FOS4R to implement security-by-design principles for protecting sensitive Fibre Optic Sensing data.
• DQS (Deutsche Gesellschaft zur Zertifizierung von Managementsystemen)minorOthersThird-party certification body that conducted ISO 27001 and ISO 9001 audits for INCYDE.
• ENXminorOthersENX portal provides access to TISAX assessment results for automotive security information protection.
• CISCOminorStrategic or Co-development PartnerProject partner in CYSIS working group for IoRT Security whitepaper development.
• ÖBB (Austrian Federal Railways)minorStrategic or Co-development PartnerProject partner in CYSIS working group for IoRT Security whitepaper development.

Scale indicators3 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• Claroty: Industrial/OT cybersecurity firm offering asset discovery, threat detection, and vulnerability management for critical infrastructure, manufacturing, and rail environments. Directly comparable as a specialist IT/OT cybersecurity provider targeting the same industrial verticals.
• Nozomi Networks: OT and IoT security vendor providing network visibility, threat detection, and asset monitoring for industrial, energy, and transportation sectors. Comparable as an OT cybersecurity specialist serving overlapping industrial customer segments.
• Forescout: Cybersecurity firm specializing in OT/ICS visibility, network access control, and industrial cybersecurity across critical infrastructure. Comparable as a specialist provider of IT/OT security solutions for industrial operators.
• ERNW Research: Germany-based independent IT security consultancy offering penetration testing, security assessments, and research-grade expertise across enterprise and industrial clients. Directly comparable as a DACH-rooted specialist cybersecurity consulting firm.
• Kaspersky Industrial CyberSecurity: Industrial cybersecurity division providing specialized OT/ICS threat detection, incident response, and vulnerability assessment for industrial operators. Comparable as a specialist IT/OT cybersecurity provider addressing industrial threat analysis and security testing.

Broad incumbents

• NCC Group: Global cybersecurity consulting firm providing penetration testing, red teaming, and security advisory across critical infrastructure, industrial, and transport clients. Comparable as a broad incumbent cybersecurity consultancy serving regulated industrial customers.
• Mandiant (Google Cloud): Global cybersecurity consulting firm specializing in incident response, threat intelligence, and security assessments for enterprise and industrial clients. Comparable as a broad incumbent offering similar cybersecurity advisory and testing services.
• TÜV Rheinland: International testing and certification organization providing cybersecurity assessments, industrial system certification, and conformity services for rail, automotive, and industrial sectors. Comparable as a broad incumbent with overlapping IT/OT security assurance offerings.
• TÜV SÜD: Global testing, inspection, and certification body with industrial cybersecurity services spanning rail, automotive, energy, and industrial verticals. Comparable as a broad incumbent offering overlapping IT/OT security assessment and certification services.

Emerging players

• Oneconsult: Swiss-based boutique cybersecurity consultancy offering penetration testing, red teaming, and security assessments for enterprise clients in DACH and beyond. Comparable as a smaller specialist cybersecurity consulting peer operating in overlapping European geographies.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/incyde

Compliance3 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles6 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about INCYDE