Knowledge. Practice. Orientation.

Consulting portfolio, whitepapers, studies and practical guides on current security and compliance topics — concise, well-founded, ready to use.

Knowledge by topic

Our knowledge is organized into five topic areas. Each topic area has its own knowledge page with in-depth content, related pages and the matching whitepapers for download.

GRC – Governance, Risk & Compliance

ISO 27001, BSI IT-Grundschutz, DORA, NIS2, the EU CRA and the EU AI Act — governance, risk management and audit-ready compliance.

38 TopicsExplore topic

IT Security

Penetration testing, secure coding, threat modeling and a secure SDLC — technical security across the entire lifecycle.

25 TopicsExplore topic

Agentic AI Security

LLM & agentic-AI pentesting, prompt injection, OWASP LLM Top 10 and AI threat modeling — securing AI systems.

36 TopicsExplore topic

Cloud Security

CSPM & CNAPP (partner: Wiz), sovereign cloud architecture, BSI C5, ISO 27017 and the EU Cloud & AI Act (CADA) — cloud security, compliance and sovereignty as one.

10 TopicsExplore topic

Secure Software & Product Development

Secure coding, SSDLC and supply chain security (SLSA, SBOM), plus product security by product type: CRA, IEC 62443, UN R155 and ISO/SAE 21434 for vehicles, MDR for medical devices.

43 TopicsExplore topic

Vami ResearchThe research behind our knowledge baseVami Research brings together our analyses, threat briefings and whitepapers in research areas – with a focus on agentic AI security and agentic GRC engineering.Explore Vami Research

News & pinned posts

Partnerships, milestones and new offerings — the most important posts from the VamiSec universe.

All news

📌 PinnedSecure DevelopmentOctober 31, 2026Claude Code extension tampered with in the Cursor marketplace: what developer teams need to know about the SSH backdoorTampered versions of the Claude Code extension in the Cursor marketplace set up SSH backdoors on developer machines. We explain what the malicious code did, how to check whether you are affected and which steps are needed now.Read more →

📌 PinnedIT SecurityOctober 27, 2026Brotli2Shell (CVE-2026-111497): What organizations need to know about Node2Shell and HTTP2Shell nowCritical flaw in Google's Brotli decoder: Node.js, .NET, Python, Bun, Envoy, Istio and many other products are affected. We explain the root cause, fixed versions, attack paths and current status, and show what organizations should do now.Read more →

📌 PinnedGRC & Compliance25 October 2026VamiGRC Christmas Bootcamp on 12 December: agentic GRC engineering – on site and liveOn Saturday, 12 December 2026, VamiSec invites you to the VamiGRC Christmas Bootcamp in Sankt Augustin near Bonn – on site or live on LinkedIn and YouTube. Valeri Milke and partners show how agentic GRC engineering makes NIS2, the CRA, the AI Act and supply chain risks manageable – plus a Christmas special on post-quantum cryptography and CBOM. Participation is free of charge.Read more →

📌 PinnedSecure DevelopmentOctober 19, 2026Expert article in mt|medizintechnik: maintaining connected medical devicesIn issue 4.2026 of the trade journal mt|medizintechnik, Valeri Milke explains why vulnerability and patch management for connected medical devices are a matter of patient safety. Our new knowledge page summarises his key points and explores them in depth.Read more →

📌 PinnedSecure DevelopmentOctober 19, 2026Expert article in mt|medizintechnik: risk management for AI systems in clinical settingsIn issue 2.2026 of the trade journal mt|medizintechnik, Valeri Milke shows how hospitals can use risk management to safeguard their use of AI systems. Our new knowledge page summarises his key points, updates them and explores them in depth.Read more →

📌 PinnedGRC & Compliance6 October 2026BaFin AI Guidance: What Banks and Insurers Should Now Implement for ICT Risks under DORAOn 18 December 2025, BaFin published its guidance on ICT risks in the use of AI. It is non-binding, but across 38 pages it shows how financial entities can apply DORA’s requirements to AI systems — from governance through testing and cloud contracts to incident reporting. We have analyzed it and published an interactive knowledge page plus a CISO whitepaper.Read more →

📌 PinnedGRC & Compliance24 September 2026EBA Guidelines on Third-Party Risk 2026: What Financial Entities Now Need to Know about Non-ICT Service ProvidersOn 18 September 2026 the EBA replaced its 2019 Outsourcing Guidelines with EBA/GL/2026/09. Every recurring non-ICT service that supports a function now falls within a DORA-consistent framework — complete with a register, a catalogue of contractual clauses, subcontracting rules and a two-year transitional period. We have worked through the Final Report and published an interactive knowledge page together with a CISO whitepaper.Read more →

📌 PinnedGRC & Compliance24 August 2026MID-Digitale Sicherheit: 50% grant for pentests, training & baseline IT protectionNew overview page: the NRW programme funds IT security measures with a 50% grant (€4,000–15,000) — from as-is analysis with penetration testing to security training and the initial purchase of hardware & software. Awarded in a monthly lottery via NRW.BANK — we support you from expression of interest to proof of use.Read more →

📌 PinnedGRC & Compliance24 August 2026MID-Digitalisierung: 50% grant for developing digital productsThe NRW programme funds external services for developing marketable digital products built on key technologies such as AI with a 50% grant (€4,000–15,000), awarded in a monthly lottery. VamiSec develops as your contractor with security by design plus CRA and AI Act conformity from the first sprint.Read more →

📌 PinnedGRC & Compliance12 August 2026Up to €15,000 in grants: GRC consulting via MID-Digitale Prozesse (NRW)The NRW state programme “Mittelstand Innovativ & Digital” funds external consulting for digitalising your GRC processes — from NIS2, CRA, EU AI Act and ISO 27001 gap analyses to roadmap, tool selection and VamiGRC implementation. The grant can cover up to 100% of the consulting. 2026 call: applications from 7 Sep to 1 Dec 2026 via NRW.BANK — we guide you through the entire funding process.Read more →

📌 PinnedCloud SecurityMay 1, 2026VamiSec is a member of the Wiz Partner Alliance in EMEA — with Technical Foundations and Demo AccreditationVamiSec GmbH is a member of the Wiz Partner Alliance for the EMEA region — listed in the Wiz Partner Alliance Directory and holding the Wiz Partner Technical Foundations Badge as well as the Wiz Partner Demo Accreditation.Read more →📌 PinnedCompanyApril 19, 2026VamiSec and softScheck — strategy meets technical depthValeri Milke also takes on the role of Managing Director at softScheck GmbH. VamiSec remains the strategic home for GRC, compliance, and management systems — complemented by softScheck’s 20+ years of product security expertise (threat modeling, pentest, SSDLC, fuzzing).Read more →

AI SecurityOctober 31, 2026CyberWiseCon Europe 2027 in Riga: Valeri Milke speaks on threat modeling and agentic AI red teamingOur talk “Securing Agentic AI: Threat Modeling & Agentic AI Red Teaming in Practice” has been accepted for CyberWiseCon Europe 2027. Valeri Milke speaks in Riga in May 2027 – with a repeatable path from the trust boundary to evidence that controls hold.Read more →CompanyOctober 31, 2026it-sa 2026 recap: VamiGRC live at the BITMi stand, six demos and a dinner on the CRA reporting obligationThree days at the BITMi joint stand: six VamiGRC live demos, many conversations about NIS2, the CRA, AI security and pentests, and a dinner on the CRA reporting obligation. Our recap with photos.Read more →AI SecurityOctober 18, 2026DevFest Nairobi 2026: Valeri Milke on securing AI agents with threat modeling and agentic AI red teaming14 November, Sarit Expo Centre, Nairobi: our session “Securing Agentic AI” has been accepted for DevFest Nairobi 2026. Valeri Milke will show how development teams can model the permissions, tools and trust boundaries of AI agents, test them through red teaming and prove that their controls work.Read more →CompanySeptember 22, 2026VamiSec speaks at International Cyber Expo 2026: Agentic AI Risk Assessment with MAESTRO & AI Red Teaming30 September, Global Cyber Summit, Olympia London: Valeri Milke shows how to model agentic-AI risks with MAESTRO, test them through AI red teaming and translate them into enterprise controls that hold up. Two event days, free registration — and our talk at 15:15.Read more →GRC & ComplianceSeptember 13, 2026VamiSec on site in Tallinn: Trust Services and eID Forum & CA-Day 202615–16 September, Kultuurikatel Tallinn: ENISA, the European Commission, D-Trust and TÜV NORD Cert gather Europe's trust community — eIDAS 2.0, EUDI Wallet, European Business Wallet, CRA cross-overs and post-quantum. We are there and translate what it means for your compliance.Read more →IT Security1 August 2026VamiSec becomes a CrowdStrike partner — Falcon from a single sourceVamiSec is an authorised CrowdStrike implementation and reselling partner: licensing, rollout and 24/7 operation of the AI-native Falcon platform — from EDR/XDR to cloud security, identity protection and MDR. Full details on our CrowdStrike landing page.Read more →

Consulting Portfolio · 2026

VamiSec Consulting Portfolio 2026

Trusted · Holistic · Engineered

Our complete service portfolio in one deck — from ISO 27001, NIS2, DORA and CRA to IT- & Cloud Security, AI Governance, Managed Services and the Vami IMS Framework. 27 pages, compact.

📄 27 pages·2.7 MB · PDF·EN

View online →↓ Download PDF