SOLUTIONS CATALOGUE // 10 SPECIALIZED MODULES
Solutions
Fifteen, chosen from fifty-seven.
We mapped fifty-seven cybersecurity projects across the European market. These fifteen are the ones a client can buy today. The other forty-two are real, and most of them are coming — but a solutions page listing capabilities you cannot staff is the fastest way to lose a technical buyer.
How these fifteen were selected
- Tier 1 — buying today
- 19 projects
- Tier 2 — maturing in 12–36 months
- 27 projects
- Tier 3 — future capability
- 11 projects
These fifteen are every Phase 1 project in the portfolio, plus the three marked Phase 1/2, plus OT/ICS — a Tier 1 project too large to leave out.
| # | Solution | Why a European buys it | Need | Competition | Phase |
|---|---|---|---|---|---|
| 01 | SOC & MDR→ | NIS2 obliges detection capability and a 24-hour incident notification. Almost nobody in the mid-market can staff that. | Very high | High | Phase 1 |
| 02 | Penetration testing & VA | Required by DORA, by ISO and PCI certification, and increasingly by cyber insurers before they will quote. | Very high | High | Phase 1 |
| 03 | GRC & regulatory advisory | Five overlapping regimes — NIS2, DORA, CRA, GDPR, AI Act — and no internal function that owns them. | Very high | Medium | Phase 1 |
| 04 | Cloud security | Misconfiguration remains the leading cause of European cloud breaches, and sovereignty pressure is reshaping every architecture. | Very high | High | Phase 1 |
| 05 | Identity & Zero Trust | Identity is the perimeter now. Zero Trust is what NIS2 supervisors expect to see when they ask about access control. | Very high | High | Phase 1 |
| 06 | Endpoint EDR/XDR | Table stakes, and the fastest route into a managed contract — most clients already own a tool nobody operates. | High | Very high | Phase 1 |
| 08 | Incident response & DFIR | When it happens you cannot start procuring. A retainer is the product; the forensic evidence has to stand up in court. | Very high | Medium | Phase 1 |
| 10 | OT/ICS security | Manufacturing attacks grew 84% in early 2025, and NIS2 puts industrial operators squarely in scope. | Very high | Medium | Phase 2 |
| 13 | Awareness & phishing simulation | The cheapest measurable risk reduction available, and the one an auditor asks for evidence of first. | High | Medium | Phase 1 |
| 15 | Cyber resilience & DR | DORA made tested recovery a legal obligation, not an IT aspiration. Most backup plans have never been tested. | Very high | Medium | Phase 1 |
| 16 | AI security & governance | The AI Act arrives with no established supplier market. Demand is exploding and competition is genuinely low. | Exploding | Low | Phase 1 |
| 20 | AI red teaming & LLM testing | Everyone is shipping AI features; almost nobody is testing them adversarially. First-mover territory. | Exploding | Low | Phase 1 |
| 30 | Compliance automation platform | Turning five regulations into continuously maintained evidence instead of an annual fire drill. | The decade’s story | Medium (EU gap) | Phase 1/2 |
| 54 | PSIRT as a service (CRA) | Reporting duties bind in September 2026. Thousands of manufacturers need a function that essentially no one sells as a standing service. | Legally certain | Nearly none | Phase 1/2 |
| 55 | M&A cyber due diligence | A live, stable market where the only real incumbents are the Big Four — and their price excludes the mid-market entirely. | High | Big Four only | Phase 1/2 |
The other forty-two are not hidden. Post-quantum migration, drone and robotics security, maritime and rail, satellite, deepfake defence, quantum networks — all mapped, several already in research. We will talk about any of them. We just will not put a page on this site claiming a service we cannot staff on Monday.
