Managed services
Managed services: operate and report.
We run the daily work for you and report on it, while decisions stay with your named owners.
Managed services keep controls working after go-live: identity and privileged access operations, cloud posture monitoring, privacy operations and an external data protection officer, and AI governance with continuous red teaming. You get agreed service levels and regular reports for management and the board.
Service domain 1
Cybersecurity
What we run for you in this domain
- Managed identity operations
- PAM as a service
- Continuous cloud posture monitoring
Managed services in each service
- Cloud Security
We run your cloud 24×7: operations, monitoring, consumption reporting, cost optimisation and vendor management. - Identity & Access Management
We run your identity operations after go-live: application onboarding, joiner, mover and leaver processes, access reviews, maintenance and upgrades. - Privileged Access Management
We run PAM as a service: onboarding of systems and accounts, rotation, reviews, platform maintenance and reporting. - Security Strategy & GRC
We run ongoing GRC activities: risk reviews, internal audits, control monitoring and regulatory change tracking.
Service domain 2
Data Protection & Privacy
What we run for you in this domain
- External data protection officer (externer Datenschutzbeauftragter)
- Data subject request handling
- Privacy operations
Managed services in each service
- Privacy Programme (GDPR and APPI)
We run privacy operations for you: rights requests, records upkeep, vendor reviews and breach assessments. - DPIA & Privacy by Design
We review new systems and AI uses, keep DPIAs and the records of processing current and monitor how personal data flows into AI tools. - Data Discovery & Classification
We run classification and DLP for you: alert triage, policy tuning, label coverage reports and retention. - External Data Protection Officer
We act as your external data protection officer, with regular audits, advice, training and reporting.
Service domain 3
AI Security & Governance
What we run for you in this domain
- Managed AI governance
- Continuous AI red teaming
- Board reporting
Managed services in each service
- AI Readiness Assessment
After the assessment, we keep the inventory and classifications current as a managed service, so the result does not go out of date. - EU AI Act Compliance
We keep classifications, obligations and evidence current as a managed service, and review new AI uses as they come in. - AI Risk Management & ISO/IEC 42001
We run the AI management system with you: risk reviews, internal audits, management review input and surveillance audit preparation. - AI Security & Red Teaming
We retest AI applications after changes and on a schedule, and monitor guardrails and agent permissions as a managed service.
Managed AI Governance
AI governance that runs every week, without building a new team for it.
- Onboard
We agree scope, roles, approval limits and reporting with you, and take over your existing AI register and policies.
- Run intake
We review new AI requests, pre-classify them by EU AI Act tier, check vendors and route decisions to your named approvers.
- Monitor
We watch for shadow AI, ownerless agents, failing controls and expiring exceptions, and follow up with the owners.
- Keep evidence current
We collect and maintain evidence for each AI system and obligation, so it is ready when an auditor or authority asks.
- Report to the board
We prepare regular reports on AI risk, open findings and decisions for management and the board, on the schedule you set.
What you get
- Current AI inventory with owners
- Reviewed and routed AI requests with recorded decisions
- Findings and follow-ups on shadow AI, agents and exceptions
- Evidence packs for audits and authority requests
- Regular management and board reports on AI risk
AI automation in this service
- Automated EU AI Act pre-classification of new AI requests, reviewed by our consultants before routing.
- Automated discovery of new AI apps and agents from Microsoft 365, Entra and Defender data, with alerts for unapproved use.
- Automated collection of evidence and generation of board reports from the decision log.
How a managed service runs
- Onboard
We agree scope, roles, approval limits and service levels and take over your existing set-up.
- Operate
We do the daily work: reviews, onboarding, monitoring, requests and follow-ups with owners.
- Report
You get regular reports for management and the board, on the schedule you set.
- Improve
We review findings and the service with you and adjust controls and processes.
Frequently asked questions
Who makes the decisions?
You do. We prepare, review and follow up, but approvals and accepted risks stay with your named owners.
Which service levels do you offer?
We agree response times, reporting and escalation per service in the contract, based on your risk and your internal processes.
Can we start with one domain?
Yes. Many clients start with one service, such as PAM or managed AI governance, and add others later.
Can we bring the work back in-house later?
Yes. Your data, configuration and documentation stay in your environment, so your team can take over at any time.
Can we start before the platform launches?
Yes. We can run the service with your existing tools and move it to the platform when it launches in December 2026.
Does this replace our data protection officer or CISO?
No. We support them with the daily governance work, and they keep their responsibilities and reporting lines.
Consulting · Professional services · Managed services
Start with a 30-minute AI risk conversation.
A senior consultant replies within one business day. Or join the 3–5 design partners shaping the platform before launch.