CERTAINITY

What CERTAINITY does

CERTAINITY is an owner-managed European cybersecurity consulting firm headquartered in Vienna, Austria, with a wholly-owned German subsidiary (CERTAINITY Deutschland GmbH) in Neu-Isenburg. Founded in 2022, the company operates across four practice pillars—Offensive Security, Defensive Security, Process Consulting, and Secure Engineering—serving mid-to-large enterprises in the DACH region (Austria, Germany, and Switzerland). Its core service portfolio includes Digital Forensics & Incident Response (with a 24/7 CSIRT hotline), Pentesting & Attack Simulation (Red Teaming, Social Engineering, Initial Compromise Assessments), Secure Product & Software Development, Governance Risk & Compliance, Security Awareness & Readiness, and Audits & Assessments. Specialized offerings cover NIS2/NISG, the EU Cyber Resilience Act (CRA), ISO 27001 certification, and SME-focused cybersecurity.

The company's technology base is methodological rather than software: it deploys a proprietary Three-Abstraction-Level Threat Modeling methodology (System, Component, and Information levels) and an FMEA-based risk scoring model aligned to IEC 62443 Security Levels for OT/IT and Industry 4.0 environments. It also maintains an active security research program producing published CVEs (e.g., CVE-2023-0861, CVE-2023-0862, CVE-2023-3630) and a structured responsible-disclosure process. The NIS2 Sensor 2026 is a freemium assessment tool used for lead generation. There is no proprietary SaaS or product platform; the offering is expertise-driven professional services.

Commercially, CERTAINITY is a sales-led consulting firm with a 100% direct-engagement distribution model. Pricing is custom-scoped per project; publicly disclosed figures are employer-side salaries (€50K–€75K+ gross) not client billing rates. The firm reports more than 230 completed projects and more than 100 clients. It is a Qualified Stelle under Austrian NIS law, enabling it to conduct official NIS audits, and has been certified as a Great Place to Work in 2024 and 2025, including Best Workplaces Austria 2025. The firm is privately owned by its founders (no VC/PE ownership disclosed), with a holding-company structure (CERTAINITY Holding GmbH) and operating subsidiaries in Austria and Germany.

Name

CERTAINITY

Legal name

CERTAINITY Holding GmbH

Website

https://certainity.com

Company type

Private

Founded year

2022

Operating status

Operating

Headcount range

11–50 employees

Short description

CERTAINITY is a Vienna-based, owner-managed cybersecurity consulting firm offering offensive security, defensive security, process consulting, and secure engineering services—including DFIR, Red Teaming, NIS2/ISO 27001 compliance, and CRA support—to mid-to-large enterprises across the DACH region.

Ownership category

akta.pro rank

Product category

Cybersecurity Consulting

NAICS

Management, Scientific, and Technical Consulting Services (5416), Management Consulting Services (54161), Investigation and Security Services (5616)

SIC

Services-Computer Programming, Data Processing, Etc. (7370), Services-Detective, Guard & Armored Car Services (7381)

akta.pro primary industry

Cybersecurity & Identity Consulting (BPAHAEAG)

akta.pro secondary industry

Privacy, Data Protection & Cyber Governance (GRC) (BPAHAFAF)

Keywords

• Cybersecurity consulting services
• Incident response services
• Penetration testing services
• Security compliance consulting
• Red team assessments

Headquarters

HQ city

Vienna

HQ country

Austria

HQ region

Europe

Offices2 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Marketing or Sales, Technology or R&D

Revenue model

1. Professional Cybersecurity Consulting Services: The primary revenue stream consists of billable consulting engagements across the company's practice areas: Digital Forensics & Incident Response, Pentesting & Attack Simulation (including Red Teaming, Initial Compromise Assessments, DDoS simulations), Secure Product & Software Development, Governance, Risk & Compliance, Security Awareness & Readiness, and Audits & Assessments. Engagements are scoped and priced per project, with senior consultants commanding higher rates. This is a services-heavy model with no SaaS or product component disclosed.
2. Training and Awareness Programs: Revenue generated from security awareness training programs, readiness workshops, incident simulation exercises, and conference presentations. These are delivered as standalone or bundled offerings within broader consulting engagements.
3. Regulatory Compliance Consulting (NIS2, ISO 27001, CRA, DORA): Specialized consulting engagements focused on regulatory compliance preparation, certification support (e.g., ISO 27001 audits as a Qualified Stelle under Austrian NIS law), and gap assessments for NIS2, Cyber Resilience Act (CRA), and DORA. These engagements are billed as professional services with defined project scopes.

Pricing tiers

Go-to-market motion1 record

Distribution channels1 record

Marketing channels6 records

Core offering

CERTAINITY is an owner-managed European cybersecurity consulting firm that delivers expert services across offensive security (penetration testing, Red Teaming, Social Engineering), defensive security (Digital Forensics & Incident Response with a 24/7 emergency hotline), process consulting (NIS2, DORA, CRA, ISO 27001), and secure product/software development (Threat Modeling, SDLC, OWASP SAMM). The firm is a Qualified Stelle under Austrian NIS law, enabling it to conduct official NIS audits. Engagements are custom-scoped and billed on a project/professional services basis.

Product overview

CERTAINITY is an owner-managed European cybersecurity consulting firm providing a comprehensive portfolio of security services rather than a software product platform. The core offerings include Digital Forensics & Incident Response (with 24/7 emergency hotline), Pentesting & Attack Simulation (Red Teaming, Social Engineering), Secure Product & Software Development (aligned with OWASP SAMM, ISO 27001, CRA), Security Awareness & Readiness (training, workshops, incident simulations), Governance Risk & Compliance (NIS2, DORA, ISO 27001), and Audits & Assessments. Supporting specialized services address NISG & NIS2 compliance, Cyber Resilience Act implementation, ISO 27001 certification, and cybersecurity specifically for SMEs. The NIS2 Sensor 2026 is a complimentary assessment tool for Austrian organizations. The company maintains expertise across Offensive Security, Defensive Security, Process Consulting, and Secure Engineering disciplines.

Differentiator

Problem solved

Functional benefit

Products and services

• Digital Forensics & Incident Response Rapid incident response services including forensic analysis, evidence preservation, and coordinated response to cyber incidents for enterprises across the DACH region.
• Pentesting & Attack Simulation Offensive security testing including modern penetration tests, Red Teaming, and Social Engineering simulations to identify vulnerabilities and strengthen organizational defenses.
• Secure Product & Software Development Security consulting for development teams including training, expert support, and secure process design covering Threat Modeling through SDLC, aligned with OWASP SAMM, ISO 27001, and CRA requirements.
• Security Awareness & Readiness Security consciousness building through targeted training, readiness workshops, and realistic incident simulations to develop organizational response capabilities.
• Governance, Risk & Compliance Security and compliance management services that are pragmatic, regulatorily grounded, and individually tailored for practical implementation across NIS2, DORA, and ISO 27001 frameworks.
• Audits & Assessments Comprehensive audit support for ISO 27001, NISG/NIS2, and GDPR including internal and external audits with structured, sustainable remediation of findings.
• NISG & NIS2 Support Comprehensive NIS2 preparation support including readiness assessments, risk management implementation, compliance measures development, security concept creation, and governance reporting assistance.
• Cyber Resilience Act (CRA) Support CRA compliance implementation support including awareness workshops, readiness assessments, cyber risk assessments for products, gap analysis, roadmap planning, and improvement measure implementation.
• ISO 27001 Certification Full-service ISO 27001 certification support with qualified auditors providing pre-assessments, security measure evaluation, improvement identification, compliance action planning, audit accompaniment, and follow-up tracking.
• Cybersecurity for SMEs (KMUs) Specialized cybersecurity services tailored for small and medium-sized enterprises (SMEs) addressing their unique security needs and budget constraints.
• NIS2 Sensor 2026 A free assessment tool that evaluates how far Austrian companies have progressed in implementing NIS2 compliance requirements, helping organizations prepare for the upcoming regulatory deadline.

Quantifiable outcome

• >230 successful projects completed
• +2 more outcomes

Segments3 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature4 records

Partnerships

One partnership is on record.

• ONEKEYcoreTechnology or Integration · 20 September 2022CERTAINITY and ONEKEY maintain an active research partnership focused on product cybersecurity. ONEKEY provides automated static code analysis of firmware through its platform, while CERTAINITY contributes offensive security consulting expertise. Their joint research has produced multiple published CVEs, including vulnerabilities in NetModule routers (CVE-2023-0861, CVE-2023-0862) and KSW Web Level Control applications. ONEKEY is described as a leading European specialist in Product Cybersecurity & Compliance Management, and the partnership combines ONEKEY's automated PCCP platform with CERTAINITY's consulting expertise for comprehensive product security analysis.

Scale indicators3 records

Recent moves7 records

Expansion highlights6 records

Broad incumbents

• NCC Group: NCC Group is a global cybersecurity consulting and assurance firm with DACH delivery capability, offering red teaming, incident response, and compliance advisory comparable to CERTAINITY's full service portfolio at greater scale.
• KPMG Austria (Cyber): KPMG Austria's cybersecurity practice provides NIS2 readiness, ISO 27001, incident response, and penetration testing as part of a broader advisory portfolio, competing for the same mid-to-large Austrian enterprise compliance engagements.
• PwC Austria (Cyber): PwC Austria delivers cybersecurity consulting including NIS2 advisory, ISO 27001, penetration testing, and DFIR as part of its full advisory stack, competing for the same mid-to-large DACH enterprise compliance budgets.
• Deloitte Austria (Cyber): Deloitte Austria's cyber risk services span GRC, red teaming, secure development, and incident response, offering enterprise clients a one-stop alternative to specialist boutiques like CERTAINITY for DACH NIS2/DORA programs.

Direct peers

• SySS GmbH: SySS is a German boutique cybersecurity firm specializing in penetration testing, red teaming, and security consulting — closely comparable in services, German-speaking market focus, and boutique-firm positioning to CERTAINITY.
• Cure53: Cure53 is a Berlin-based boutique cybersecurity firm known for penetration testing, security research, and CVE publication — comparable to CERTAINITY in research-driven culture, DACH location, and offensive security depth.
• Compass Security: Compass Security is a Swiss-headquartered boutique cybersecurity firm offering penetration testing, red teaming, incident response, and security consulting — closely comparable in size, service mix, and DACH market focus to CERTAINITY.
• SEC Consult: SEC Consult is a DACH-headquartered (Vienna/Zurich) cybersecurity consulting firm offering penetration testing, red teaming, incident response, and compliance advisory — a near-direct overlap with CERTAINITY's core service lines and primary geographic market.
• TÜV AUSTRIA: TÜV AUSTRIA operates a cybersecurity and NIS2 advisory practice alongside its certification business, competing for the same Qualified Stelle-style audit and ISO 27001 engagements that CERTAINITY targets across Austrian enterprises.
• OneConsult AG: OneConsult is a Swiss boutique cybersecurity firm specializing in penetration testing, incident response, and digital forensics — a near-direct DACH peer to CERTAINITY in terms of size, services, and target customer profile.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/certainity

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Subsidiaries2 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about CERTAINITY