Phishing email
Fake invoice or parcel notification with a link
How we protect you
- Email filtering
- Awareness training
- Multi-factor authentication
IT Security, GDPR & NIS2
IT security for businesses in Vienna – multi-layered and verifiable.
We protect your network, your devices and your data – and help you implement and document the GDPR and NIS2 on the technical side.
What does IT security mean for a small or medium-sized business?
IT security means preventing attacks, data loss and outages with several layers of protection: firewall, up-to-date software, multi-factor authentication, antivirus, trained staff and separate backups. No single measure is enough – only together do they make a business resilient.
Most attacks on small businesses don’t start with a hacker at a screen but with a genuine-looking email, a stolen password or a device without updates. That is exactly where we start: pragmatically, in the right order and without overwhelming your team with technology.
Protection in four layers
What we do for your IT security
- Firewall with up-to-date rules and monitoring
- Secure remote access via VPN instead of open ports
- Network segmentation: separate networks for guests, devices and servers
- Secured Wi-Fi
- Endpoint protection with central monitoring
- Patch management for Windows and applications
- Encryption of notebooks and storage media
- Replacing devices that no longer receive security updates
- Multi-factor authentication for email and remote access
- Permission concept: everyone sees only what they need
- Protecting Microsoft 365 against phishing and account takeover
- Tested, separate backups as the last line of defence
- Awareness training on phishing and scams
- Incident plan: who does what in an attack?
- Documentation for GDPR and NIS2
- Regular review of the measures
Sensitive data
Specially protected: client and patient data
Law firms, tax advisers and medical practices process data that is particularly sensitive. We know the typical applications and workflows in these sectors and align permissions, encryption and backups with them.
Want to use AI without sensitive data leaving your organisation? With houdini, names, diagnoses and account numbers are automatically replaced with placeholders before anything is sent to the AI.
NIS2 in Austria
The NISG 2026: what applies now
Austria implements the EU NIS2 directive with the Network and Information Systems Security Act 2026 (Netz- und Informationssystemsicherheitsgesetz 2026, NISG 2026). It has been in force since 1 October 2026. Entities in scope must register, implement risk management measures and report significant security incidents.
It mainly affects medium-sized and large companies in specified sectors – including healthcare, energy, transport, digital infrastructure and certain manufacturers. Even businesses that are not directly in scope often feel NIS2 indirectly: as suppliers or service providers, they are increasingly asked by customers for evidence of their IT security.
Current details on deadlines and registration are available from the Austrian Economic Chamber (WKO, in German).
- Initial assessment of whether and how you are affected
- Inventory and risk analysis of your IT
- Technical measures: access, updates, encryption, backup
- Incident response and reporting process for security incidents
- Documentation as evidence for authorities and customers
This does not replace a legal classification – for that, it is best to also work with your legal adviser.
Most common entry points
How attacks usually begin – and what helps
Stolen credentials
A reused password from a data leak
How we protect you
- Multi-factor authentication
- Password manager
Missing updates
A known vulnerability in Windows, the browser or the firewall
How we protect you
- Patch management
- Replacing outdated devices
Open remote access
Remote Desktop directly reachable from the internet
How we protect you
- VPN
- Firewall rules
- Monitoring
Ransomware
Data and backups are encrypted and a ransom is demanded
How we protect you
- Network segmentation
- Endpoint protection
- Separate, immutable backups
Where is your IT vulnerable?
The security check shows which of these entry points are open in your organisation – and what to do first.
Request a security checkNetwork segmentation
Fire compartments for your network.
Firewall, antivirus and updates protect the entry points. But if an attacker does get onto one device, what matters is how far they can go from there. Network segmentation divides your network into separate zones – like fire compartments in a building – so that an incident stays contained.
Ransomware typically spreads from the first infected PC to file servers and backups. In a segmented network, a firewall between the zones stops exactly that movement: workstations cannot reach the backup storage directly, printers and cameras sit in their own zone, guests only reach the internet. Remote access via VPN is also limited to the zones a person really needs.
We therefore set up segmentation as standard for every client, including small offices, law firms and medical practices. For NIS2 too, network security is part of the required risk-management measures.
How segmentation works- Workstations and notebooks
- Servers, file shares and backups
- Telephony and video conferencing
- Printers, scanners, cameras, IoT devices
- Guest Wi-Fi and private devices
- Administration of switches, firewall and access points
Your network isn’t segmented? “Our IT provider says we don’t need VLANs”? Let’s talk about it.
How we work
From security check to ongoing protection
Security check
We review your firewall, accounts, devices, backups and Microsoft 365 and show you where the biggest risks are.
Action plan
You receive a prioritised list: first the things that reduce risk the most – with effort and costs.
Implementation
We implement the measures without interrupting your operations and train your team.
Ongoing protection
Monitoring, updates and regular reviews keep your level of protection high over time.
Frequently asked questions
Questions about IT security and NIS2
Your question isn’t listed? Call us on +43 1 2266 2260.
Why are small businesses a target for cyber attacks too?
Most attacks are automated: phishing emails and scans for vulnerabilities hit every business, regardless of size. Small businesses often have fewer safeguards in place and are therefore easier to hit.
What is NIS2, and does it apply to my business?
NIS2 is an EU directive for stronger cybersecurity. In Austria it is implemented by the NISG 2026, which has been in force since 1 October 2026. It mainly affects medium-sized and large companies in specified sectors such as health, energy, transport or digital services. We will work out with you whether and how you are affected.
What do I need to do if my business falls under the NISG 2026?
Entities in scope must register with the Federal Office for Cybersecurity (Bundesamt für Cybersicherheit), implement and document appropriate security measures and report significant security incidents. We support you with the technical implementation and documentation; the legal classification is best clarified additionally with your legal adviser.
What is multi-factor authentication?
With multi-factor authentication, a password alone is not enough: a code on your smartphone or a security key is also required. Even if a password is stolen, the account stays protected.
Why is network segmentation part of IT security?
Most attacks start on a single device – via a phishing email or an outdated printer. In a flat network, the attacker can reach every other system from there, including servers and backups. Segmentation splits the network into zones with a firewall in between, so an incident stays contained. That is why we set it up as standard, even for small networks.
Isn’t antivirus software enough?
No. Antivirus is an important layer, but many attacks start with stolen credentials or a convincingly genuine-looking email. Real protection comes only from the combination of firewall, updates, multi-factor authentication, a trained team and separate backups.
What happens in an attack?
What matters is acting quickly and in an orderly way: disconnecting affected systems from the network, containing the damage, restoring data from a clean backup and checking reporting obligations. With an incident plan, everyone involved knows in advance what to do.
What does IT security have to do with the GDPR?
The GDPR requires personal data to be protected by appropriate technical and organisational measures. Encryption, access rights, backups and documented processes are exactly such measures. We implement the technical side and document it.
How often should IT security be reviewed?
At least once a year, and additionally after major changes such as new locations, new software or working from home. Ongoing monitoring catches many problems in between.
