Most companies notice an attack only when it is already too late.
Sheriff is your specialised, vendor-independent partner for cybersecurity. We test your systems like a real attacker, monitor them around the clock and step in when it matters. For mid-sized companies and critical infrastructure: pragmatic and measurable.
24/7 monitoring that scales with you
Detect threats around the clock and actively stop them before damage is done.
Test before attackers do
We attack your systems like a real attacker and show you exactly what to fix.
Immediate help during attacks
Containment, recovery and forensic investigation, exactly when it counts.
Three situations in which companies call us.
Three situations, three clear answers.
Without continuous monitoring, attackers often move undetected for weeks. In one of our cases, a company first learned of a data leak through our dark-web monitoring.
Firewalls and tools say nothing about whether they withstand a real attack. The most dangerous gaps often sit at the interfaces between systems.
When vulnerabilities can't be closed or an incident is already underway, experience and speed matter. That is exactly when we step in.
Detect. Test. Respond.
For each of the three situations, the right service, and the specialists to deliver it.
Managed SOC & MDR
A team of analysts watches over your systems 24/7, detects attacks in real time and stops them before you hear about them in the morning. Including dark-web monitoring that raises the alarm the moment your data shows up somewhere.
Managed SOC & MDR
We keep watch over your IT around the clock, like a security service, only digital:
- Our team watches your systems day and night and spots attacks immediately
- When a real threat appears, we step in and stop it, not just an alert but action
- We run the necessary technology for you, so you don't have to build your own team
- Also for smaller companies: an affordable entry point instead of an expensive enterprise solution
Penetration Testing
We hack you before anyone else does: web, cloud, network. Instead of a 200-page scanner list, you get the handful of gaps a real attacker would exploit, and a clear path to close them.
Penetration Testing
We step into an attacker's shoes and test how far someone could really get:
- We test your websites, apps, networks and Wi-Fi for weaknesses
- As needed: from the outside like a stranger, or with insider knowledge
- We also test your people, for example with real but harmless test emails
- Instead of an incomprehensible list, you get clear priorities: what to do first
Incident Response & Forensics
When things catch fire, we're there: stop the attack, restore operations and investigate fully, even without prior monitoring. You're back up and running quickly and know exactly what happened and how to prevent it next time.
Incident Response & Forensics
If something has happened, we're there immediately and get you running again fast:
- In an emergency, we stop the attack and restore your operations
- We investigate fully what happened, court-ready for insurers and authorities
- Specialised in ransomware: recover data and find the root cause
- On request, guaranteed standby so no time is lost in an emergency
Real cases. Anonymised, but not sugar-coated.
Ransomware, no monitoring, full investigation
Several servers encrypted, logs deleted by the attacker, no SIEM, no EDR. From Windows artefacts alone, we reconstructed the complete attack timeline over roughly 48 hours.
The attack the dark web gave away
Internal documents surfaced on the dark web before the client noticed anything. We worked backwards: from the confirmed leak (2.72 GB) to the compromised endpoint.
Security at the interfaces
For a multi-app SaaS platform (HR and payroll data), we tested five applications plus the cloud, and specifically what no one finds when testing them in isolation: the trust relationships between the systems.
Planning a change: migration, NIS2 or new systems?
Then it pays to look at security before you invest. In a free security workshop, our experts review your specific situation together with your management and IT, pragmatically and without any product sales pitch.
German accessibility, international firepower.
Not pure consultants but practitioners who carry out attacks and investigate incidents. Part of the international SHERIFF Group.
We carry out attacks and investigate incidents ourselves, rather than just advising.
A dedicated contact in Germany, with scalable delivery across DE/CH/FR/RO behind it.
We recommend what fits your situation, not what we happen to sell.
Roles and expertise instead of names.
The technical depth of our team, proven by verified certifications, without disclosing names.
SOC & Incident Response Lead (L3)
- MSSP
- SOC
- MDR
- DFIR
Senior Penetration Tester (Lead)
- Pentest
- Attack Simulation
Web, API & Mobile App Pentester
- Web Pentest
- API Pentest
- Mobile Pentest
Cloud Security Consultant
- Cloud Security
- Identity
Lead Auditor (GRC / Compliance)
- Audits
- NIS2
- ISO 27001
Our work is aligned with NIST CSF 2.0, NIST SP 800-61 & SP 800-115, ISO/IEC 27001*, SANS, MITRE ATT&CK, OWASP, CIS Controls, BSI IT-Grundschutz and TIBER-EU.
* aligned with the standard; formal ISO/IEC 27001 certification of the GmbH is in preparation.
Together with strong technology and delivery partners.
