CybervetterIndependent Cybersecurity Assurance

Independent · Evidence-led · EU

We vet systems, suppliers and people.

CYBERVETTER is an independent European cybersecurity assurance firm. We assess what others build, sell and claim — and we hand over evidence you can check yourself.

Discuss an engagementAll services
01

The three questions we are hired to answer

  • Is this actually secure?

    Systems, cloud estates, suppliers, acquisition targets, AI models. Independent technical assurance from people with no stake in the answer.

    Vetting

  • Can we prove it to a regulator?

    NIS2, DORA, ISO 27001, GDPR, the Cyber Resilience Act. Compliance built as a working management system, not a binder.

    Governance, Risk & Compliance

  • What do we do right now?

    Incident response, forensics, crisis leadership. Certified investigators who have run real incidents.

    Incident Response & Digital Forensics
02

What we do

Six practices and thirty-three services, from architecture vetting to forensic investigation, so a single question does not have to be split across several firms.

01VettingIndependent assurance over systems, suppliers and people.IncludesSystem & Architecture VettingSupplier & Third-Party VettingPersonnel Security Vetting & Insider RiskView practice02Governance, Risk & ComplianceSecurity that survives contact with an auditor and a regulator.IncludesNIS2 Readiness & ImplementationISO/IEC 27001 ISMS Implementation & Internal AuditCyber Risk Management & AssessmentView practice03Technical Assurance & Offensive SecurityFind it before someone else does, then fix the reason it was there.IncludesPenetration TestingVulnerability Management as a ServiceCloud Security Assessment & HardeningView practice04Incident Response & Digital ForensicsWhen it has already happened, and the next hour decides how bad it gets.IncludesIncident Response RetainerIncident Response Planning & PlaybooksDigital Forensics & InvestigationView practice05CyberFinanceDigital operational resilience and financial crime defence for regulated finance.IncludesDORA Programme & Gap AssessmentICT Third-Party Risk & Register of InformationResilience Testing & TLPT AdvisoryView practice06Capability & ResourcingBuild security capability inside your organisation, or bring in ours.IncludesFractional CISO / Virtual CISOExpert Sourcing & Consultant SecondmentSecurity Awareness & Phishing SimulationView practice
03

The regulatory clock

These are your deadlines. Each obligation below already applies to client organisations, or applies from the date shown.

Cyber Resilience Act · Deadline imminent

Vulnerability reporting obligations begin for manufacturers

Cyber Resilience Act guidance

NIS2 · Deadline

Enforceable across the European Union

Romania: GEO 155/2024, Law 124/2025, DNSC Orders 1 and 2/2025.

NIS2 guidance

DORA · Deadline

Applicable to financial entities and their critical ICT providers

DORA guidance

AI Act · Deadline

Article 50 transparency obligations apply

AI Act guidance

Cyber Resilience Act · Deadline

Full application, conformity assessment and CE marking

04

What you can check

Every finding comes with the evidence behind it

A penetration test finding arrives with reproduction steps, so you can run it yourself. An architecture review cites the specific configuration it is describing. A supplier assessment shows what we saw and where. A risk rating explains the reasoning, so you can disagree with it. Assurance work is only worth what its evidence is worth, and we hand the evidence over.

05

Independence

We sell nothing but judgement

How independence is maintained
  • We do not resell security products.
  • We do not manage client infrastructure.
  • We take no vendor commission and hold no reseller agreement.
06

Credentials

Certified practitioners on every engagement

Certifications held

  • CISSP
  • CISA
  • CISM
  • CRISC
  • CGEIT
  • TOGAF 9
  • ISO/IEC 27001 Lead Auditor
  • CEH
  • CHFI
  • CSSLP
  • CompTIA CASP+
  • PRINCE2
  • SAFe
  • PM2
  • ISTQB
  • ITIL

The practice maps to the role profiles of the ENISA European Cybersecurity Skills Framework.

Capability of the team
07

Latest from Insights

InsightThe CRA Reporting Clock Started. Most Manufacturers Cannot Yet Meet It.The Cyber Resilience Act's vulnerability reporting obligations took effect on 11 September 2026. The timelines are measured in hours, and they assume a manufacturer already knows what is inside its own products — which is the part most organisations have not solved.Marieta MusatCybersecurity Consulting Manager, CYBERVETTERInsightThe Certificate Is Issued to a System, Not to a WeekAn audit samples a fortnight of evidence and infers a year of behaviour. That inference only holds where the management system runs on habit rather than on preparation — which is a question about people, not about documentation.Marieta MusatCybersecurity Consulting Manager, CYBERVETTERInsightSecurity Left, Security in the Cloud, and the New Question of Securing AI ItselfDevSecOps and cloud security are now well-established disciplines — but AI is reshaping both how software gets built and what security teams need to defend. A practical look at where the real risk sits, beyond the hype.Marieta MusatCybersecurity Consulting Manager, CYBERVETTER
All insights

Tell us what you need assessed

Describe the system, supplier or obligation in question and we will tell you how we would approach it.

Contact us

Responding to an incident now? Incident contact.