Progress needs a reliable framework.
Technological development changes how companies recognize risks, make decisions and remain able to act. That applies to us as well. New technologies, methods and partnerships make our work more effective. That is exactly why we ask three questions of every further development.
Right, controllable, compliant.
For us, innovation is not an end in itself. What matters is whether it creates capabilities that move companies forward, and whether we can use them responsibly. For this, binding foundations for the whole group apply first.
What we do and what we deliberately do not do.
Offensive testing, intelligence and artificial intelligence are powerful capabilities. That is why they need clear limits: an unambiguous mandate, proportionality and people who bear responsibility for decisions.
Recognize risks early, take them deliberately.
Every new technology creates new opportunities and new dependencies. We want to recognize risks before they become an incident. That applies to the work with our clients just as much as to our own group.
Follow rules, demonstrate effect.
New requirements often emerge faster than established practice, for example in the use of AI, in handling data or in working with partners. We align our further development so that it stands up to serious scrutiny.
What applies to the whole group.
Further development needs a foundation that holds in day-to-day work. These rules apply in all units of the group, for every assessment, every mandate and every partnership.
Principles of conduct
A group-wide code of conduct describes how we deal with clients, partners, information and each other. It applies to all employees and is complemented by requirements for business partners.
Mandate & confidentiality
Assessments, red teaming and intelligence work only take place with a clear assignment, explicit approval and a defined scope. What we learn in the process remains confidential. Our information security management system is certified to ISO 27001:2022.
Anti-corruption & conflicts of interest
Benefits must be transparent, appropriate and lawful. Stricter standards apply toward public-sector clients. We work vendor-neutrally and disclose conflicts of interest before they can influence a recommendation.
Whistleblowing system
Possible misconduct can be reported confidentially and, on request, anonymously. Whoever gives a tip must not suffer any disadvantage as a result. The presumption of innocence applies to those affected until a violation has been proven.
Human rights & due diligence
We respect human rights in our own employment relationships and expect the same from partners and suppliers.
Risk management & internal control system
Risks are named openly, taken deliberately and steered appropriately. Controls have to work, not just be documented.
What we let ourselves be audited against.
A framework only works if it is verifiable. What we describe as principles is tied to bodies that assess it independently and renew it regularly.
ISO 27001:2022
Certified information security management system of ProSec GmbH. It governs how we handle our clients’ information and is audited regularly by an independent body.
ISO 9001:2015
Certified quality management: traceable and repeatable results, regardless of who carries out an assessment.
Qualifications of the testing teams
Recognized certifications held by our testers, kept continuously up to date. In regulated environments they are a prerequisite for carrying out an assessment.
Research allowance
Our research and development work is certified by the certification body for the German research allowance (Bescheinigungsstelle Forschungszulage). It is the basis for tax funding of our own development projects.
Where we make responsibility concrete.
The fields do not follow individual products or business units. They describe where the prerequisites for security are changing and where ethics, risk management and compliance are therefore particularly in demand.
Understanding new risks before they become business-critical.
Companies are becoming more digital, more connected and more dependent on technologies, data, supply chains and partners. At the same time, regulatory requirements and geopolitical uncertainty are increasing. We therefore look not only at individual systems, but at the question of which changes influence a company’s ability to act.
Our five dimensions – uncover, investigate, safeguard, prove and enable – are not a rigid catalog here. They are the perspectives from which we examine new developments.
Use AI responsibly, on both sides.
AI changes analysis, evaluation and automation and with it security work. At the same time, new attack surfaces, dependencies and requirements for governance and proof are emerging. We examine where AI improves our work, which risks companies have to take into account and where human judgment remains indispensable.
Develop new capabilities, within the legal and ethical framework.
New attack methods, technologies and requirements continuously change our methods and tools. For us, research means systematically taking up these changes and making findings usable between the units. Because tools that protect could also cause harm, clear rules apply to this.
Trying things out where mistakes do no harm.
Certain capabilities only develop where people test, practice and learn from one another together. The innovation campus can become the shared place of the units for this: for technical testing, realistic exercises, training and development.
Extend capabilities without giving up independence.
Not every competence has to be created within our own group. What matters is to consciously distinguish between what we must master ourselves and where partners, research or technology providers create recognizable added value. Whoever works with us must meet the same standards of integrity, confidentiality and compliance.
Innovation becomes relevant when it turns into capability. It only becomes responsible with a clear framework.
The yardstick remains simple: what is changing for companies, what do we have to develop today so that they remain able to act tomorrow, and how do we do that in a way that is right, controllable and compliant?