# VamiSec GmbH > VamiSec GmbH – AI-driven IT Security & GRC experts based in Bonn, Germany. Penetration testing, managed security services, and compliance consulting (ISO 27001, NIS2, DORA, CRA, EU AI Act) with in-house AI tooling. Content is available in German (de), English (en), French (fr) and Spanish (es); canonical German URLs are listed below. Contact: contact@vamisec.com · +49 155 609 62044 · Bornheimer Straße 127, 53119 Bonn, Germany. ## IT Security & Penetration Testing - [IT Security](https://vamisec.com/de/it-security): Penetration testing, application security and cloud security for enterprises. - [Pentest anfragen](https://vamisec.com/de/pentest-anfrage): Free initial consultation and tailored penetration test planning. - [AI & LLM Penetration Testing](https://vamisec.com/de/ki-und-llm-pentesting): Security testing for AI systems and LLMs against the OWASP LLM Top 10. - [Agentic AI Penetration Testing](https://vamisec.com/de/agentic-ai-pentesting): Offensive testing for AI agents against OWASP Agentic Threats T1–T15, MAESTRO and NIST AI RMF. - [IoT Penetration Testing](https://vamisec.com/de/iot-pentesting): Security testing for IoT devices and connected systems. - [Physical Pentesting](https://vamisec.com/de/physical-pentesting): Social engineering, access control and tailgating assessments. - [EASM – Attack Surface Management](https://vamisec.com/de/easm): Continuous external attack surface management with AI, 24/7 pentest, red teaming and dark-web monitoring. - [Compromise Assessment](https://vamisec.com/de/compromise-assessment): Forensic investigation for active and historical attacker traces. - [OT & Industrial Security](https://vamisec.com/de/ot-industrial-security): Security for industrial control and automation systems per IEC 62443. - [IT-Security Audits](https://vamisec.com/de/it-security-audits): Holistic security assessment, vulnerability analysis and compliance checks. ## Compliance & Governance - [ISO 27001 & ISMS](https://vamisec.com/de/iso-27001): ISO 27001 ISMS implementation and BSI IT-Grundschutz consulting. - [NIS2 Compliance](https://vamisec.com/de/eu-nis2): NIS2 Directive implementation — requirements, fines and security measures. - [DORA](https://vamisec.com/de/dora): DORA compliance for financial institutions — ICT risk management, incident reporting, TLPT, third-party management. - [EU AI Act](https://vamisec.com/de/eu-ai-act): EU AI Act conformity — risk classes, obligations and implementation timeline. - [KI-Compliance (EU AI Act & ISO 42001)](https://vamisec.com/de/ki-compliance): AI Act, ISO/IEC 42001, Art. 43 conformity assessment and AI Officer as a Service. - [Cyber Resilience Act (CRA)](https://vamisec.com/de/cra): CRA compliance requirements for digital products. - [ISO 42001 – AI Management System](https://vamisec.com/de/iso-42001-aims): ISO 42001 AIMS gap analysis, implementation and certification readiness. - [ISO 27701 – Privacy Information Management](https://vamisec.com/de/iso-27701): PIMS gap analysis, implementation and audit preparation per ISO/IEC 27701. - [TISAX](https://vamisec.com/de/tisax): TISAX certification for the automotive industry. - [KRITIS](https://vamisec.com/de/kritis): Consulting for critical infrastructure operators through the §39 BSIG verification audit. - [BSI C5:2026](https://vamisec.com/de/bsi-c5): German cloud security standard — 17 requirement areas, Type 1 and Type 2 attestation. - [BSI C3A – Cloud Sovereignty](https://vamisec.com/de/bsi-c3a): Cloud computing autonomy across six sovereignty dimensions. - [Audits & Certifications](https://vamisec.com/de/audits-und-zertifizierungen): Gap analyses, internal audits and external certification support. ## Managed Services & Governance-as-a-Service - [GRC as a Service](https://vamisec.com/de/grc-as-a-service): External GRC stack for ISO 27001, NIS2, DORA, CRA and the EU AI Act. - [Managed Services](https://vamisec.com/de/managed-services): SOC, ISMS as a Service, vCISO and Compliance as a Service. - [vCISO](https://vamisec.com/de/vciso): Virtual CISO and managed security services. - [ISB, CISO & AI Officer models](https://vamisec.com/de/managed-services/vciso-visb): Internal, external or hybrid governance-role models under NIS2, DORA and the EU AI Act. ## Secure Development & Product Security - [SSDLC](https://vamisec.com/de/ssdlc): Application security as an engineering discipline — STRIDE, MAESTRO, OWASP, ISO/IEC 27034, SLSA. - [Secure Coding](https://vamisec.com/de/secure-coding): Secure code by design per OWASP ASVS, ISO/IEC 27034 and OpenSSF. - [SLSA Supply Chain Security](https://vamisec.com/de/it-security/slsa-supply-chain-security): Verifiable build integrity for CRA, NIS2 and the AI Act. - [Threat Modeling (STRIDE)](https://vamisec.com/de/threat-modeling): Systematic threat analysis using the STRIDE methodology. - [Automated Threat Modeling](https://vamisec.com/de/automated-threat-modeling): Continuous, provable threat modeling from architecture diagrams. - [AI Threat Modeling MAESTRO](https://vamisec.com/de/ai-threat-modeling-maestro): Layered, architecture-specific threat analysis for AI systems. - [Product Security (ISO/SAE 21434)](https://vamisec.com/de/product-security): Automotive cybersecurity — CSMS, TARA, secure development lifecycle. - [Medical Device Cybersecurity (MDR)](https://vamisec.com/de/mdr): Product security lifecycle for medical devices per MDR and MDCG 2019-16. - [SBOM for AI](https://vamisec.com/de/sbom-for-ai): G7 baseline for AI-SBOM — 50 minimum elements, 7 clusters. - [Agent Skills Security (SKILL.md)](https://vamisec.com/de/agent-skills-security): The open standard behind AI agents — progressive disclosure, OWASP Agentic Skills Top 10, governance per ISO 42001 and EU AI Act. ## Products & Platforms - [VamiGRC](https://vamisec.com/de/vamigrc): Integrated GRC platform for ISO 27001, NIS2 and BSI IT-Grundschutz. - [VamiGuard](https://vamisec.com/de/vamiguard): Data loss prevention for generative AI (ChatGPT, Claude, Copilot), sovereign-hosted. - [VamiRedTeam](https://vamisec.com/de/vamiredteam): AI-native pentesting platform — OWASP APTS, DORA and TIBER-EU ready. - [Wiz Partner](https://vamisec.com/de/wiz): German-speaking Wiz reseller, implementation and MSSP partner. ## Training & Knowledge - [PECB Trainings](https://vamisec.com/de/pecb-trainings): ISO 27001 Lead Auditor and Lead Implementer training courses. - [Trainings & Certifications](https://vamisec.com/de/trainings-zertifizierungen): Practical trainings for CISO, ISO 27001, NIS2, EU AI Act and CRA. - [NIS2 Trainings](https://vamisec.com/de/nis2-schulungen): NIS2 training for management and IT teams. - [Wissen & Security Research](https://vamisec.com/de/wissen): Whitepapers, studies and practical guides to download. - [Blog](https://vamisec.com/de/blog): Articles on IT security and compliance. ## Company - [Über uns / About](https://vamisec.com/de/uber-uns): VamiSec GmbH — partner for IT security with over 15 years of experience. - [Referenzen](https://vamisec.com/de/referenzen): Client projects in IT security. - [Trust Center](https://vamisec.com/de/trust-center): Certifications and security policies. - [Jobs](https://vamisec.com/de/jobs): Open positions at VamiSec.