[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"node-by-slug-\u002Fen\u002Fexpertise\u002Fcybersecurity-consulting\u002Fcyber-defence-services-en":3},["Reactive",4],{"entity":5,"errors":-1},{"__typename":6,"status":7,"metatag":8,"id":202,"path":203,"hideNavigation":204,"translations":205,"sharedTeaserTitle":215,"sharedTeaserText":216,"sharedTeaserRefMedia":218,"sharedParagraphs":229,"pageIndustrieTerms":581,"pageExpertiseTerms":585,"headerParagraph":589},"NodePage",true,[9,14,18,21,25,30,34,38,42,46,50,54,58,62,66,69,73,76,79,81,84,87,91,95,99,103,107,111,115,119,123,127,131,135,139,142,145,148,151,154,157,160,163,166,170,174,177,181,185,189,192,196,200],{"tag":10,"attributes":11},"meta",{"name":12,"content":13},"title","Managed cyber defence solutions: every alert in 3 minutes",{"tag":10,"attributes":15},{"name":16,"content":17},"description","A security analyst investigates every alert within three minutes, not only critical ones. Managed cyber defence for teams without a 24\u002F7 SOC of their own.",{"tag":10,"attributes":19},{"name":20,"content":17},"abstract",{"tag":10,"attributes":22},{"name":23,"content":24},"icbm","51.525772, -0.082716",{"tag":26,"attributes":27},"link",{"rel":28,"href":29},"canonical","https:\u002F\u002Fcms.zuehlke.com\u002Fen\u002Fexpertise\u002Fcybersecurity-consulting\u002Fcyber-defence-services",{"tag":10,"attributes":31},{"name":32,"content":33},"robots","index, follow",{"tag":26,"attributes":35},{"rel":36,"href":37},"shortlink","https:\u002F\u002Fcms.zuehlke.com\u002Fapi\u002Fgraphql",{"tag":26,"attributes":39},{"rel":40,"href":41},"image_src","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Fmax_1300x1300\u002Fpublic\u002Fimages\u002FComplex_defense_systems_cyber_security_europe.png?itok=S8cqK_xt,https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002Fzuhlke_innovation_social.jpg",{"tag":10,"attributes":43},{"name":44,"content":45},"referrer","unsafe-url",{"tag":10,"attributes":47},{"name":48,"content":49},"rights","Copyright ©2026 | Zühlke Engineering AG | All rights reserved.",{"tag":10,"attributes":51},{"property":52,"content":53},"og:site_name","Zühlke Engineering AG",{"tag":10,"attributes":55},{"property":56,"content":57},"og:type","website",{"tag":10,"attributes":59},{"property":60,"content":61},"og:url","https:\u002F\u002Fwww.zuehlke.com\u002Fen\u002Fexpertise\u002Fcybersecurity-consulting\u002Fcyber-defence-services",{"tag":10,"attributes":63},{"property":64,"content":65},"og:title","Managed cyber defence solutions: every alert in 3 minutes – Zühlke",{"tag":10,"attributes":67},{"property":68,"content":17},"og:description",{"tag":10,"attributes":70},{"property":71,"content":72},"og:image","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Fmax_1300x1300\u002Fpublic\u002Fimages\u002FComplex_defense_systems_cyber_security_europe.png?itok=S8cqK_xt",{"tag":10,"attributes":74},{"property":71,"content":75},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002Fzuhlke_innovation_social.jpg",{"tag":10,"attributes":77},{"property":78,"content":72},"og:image:url",{"tag":10,"attributes":80},{"property":78,"content":75},{"tag":10,"attributes":82},{"property":83,"content":72},"og:image:secure_url",{"tag":10,"attributes":85},{"property":83,"content":86},"https:\u002F\u002Fwww.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002Fzuhlke_innovation_social.jpg",{"tag":10,"attributes":88},{"property":89,"content":90},"og:image:alt","image",{"tag":10,"attributes":92},{"property":93,"content":94},"og:updated_time","2026-10-02",{"tag":10,"attributes":96},{"property":97,"content":98},"place:location:longitude","7.438014",{"tag":10,"attributes":100},{"property":101,"content":102},"place:location:latitude","46.947944",{"tag":10,"attributes":104},{"property":105,"content":106},"og:street_address","80 Great Eastern Street",{"tag":10,"attributes":108},{"property":109,"content":110},"og:locality","London",{"tag":10,"attributes":112},{"property":113,"content":114},"og:region","England",{"tag":10,"attributes":116},{"property":117,"content":118},"og:postal_code","EC2A 3JL",{"tag":10,"attributes":120},{"property":121,"content":122},"og:country_name","United Kingdom",{"tag":10,"attributes":124},{"property":125,"content":126},"og:email","london@zuhlke.com",{"tag":10,"attributes":128},{"property":129,"content":130},"og:phone_number","+44 20 7113 5000",{"tag":10,"attributes":132},{"property":133,"content":134},"og:locale","en_CH",{"tag":10,"attributes":136},{"property":137,"content":138},"og:locale:alternate","de_CH",{"tag":10,"attributes":140},{"property":137,"content":141},"de_DE",{"tag":10,"attributes":143},{"property":137,"content":144},"en_DE",{"tag":10,"attributes":146},{"property":137,"content":147},"en_AT",{"tag":10,"attributes":149},{"property":137,"content":150},"de_AT",{"tag":10,"attributes":152},{"property":137,"content":153},"en_HK",{"tag":10,"attributes":155},{"property":137,"content":156},"en_SR",{"tag":10,"attributes":158},{"property":137,"content":159},"en_BG",{"tag":10,"attributes":161},{"property":137,"content":162},"en_SG",{"tag":10,"attributes":164},{"property":137,"content":165},"en_GB",{"tag":10,"attributes":167},{"property":168,"content":169},"article:publisher","https:\u002F\u002Fwww.facebook.com\u002Fzuehlke.group",{"tag":10,"attributes":171},{"property":172,"content":173},"article:published_time","2026-03-04",{"tag":10,"attributes":175},{"property":176,"content":94},"article:modified_time",{"tag":10,"attributes":178},{"name":179,"content":180},"twitter:card","summary_large_image",{"tag":10,"attributes":182},{"name":183,"content":184},"twitter:site","@zuehlke_group",{"tag":10,"attributes":186},{"name":187,"content":188},"twitter:site:id","247189965",{"tag":10,"attributes":190},{"name":191,"content":90},"twitter:image:alt",{"tag":10,"attributes":193},{"name":194,"content":195},"twitter:image","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Fmax_1300x1300\u002Fpublic\u002Fimages\u002FComplex_defense_systems_cyber_security_europe.png?itok=S8cqK_xt,https:\u002F\u002Fwww.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002Fzuhlke_innovation_social.jpg",{"tag":10,"attributes":197},{"name":198,"content":199},"google-site-verification","VEzolc1Vxy1KyRIlIqUSmVS7fqP_3_ZeBqPRby4g2mE",{"tag":201},"script","26967","\u002Fen\u002Fexpertise\u002Fcybersecurity-consulting\u002Fcyber-defence-services",false,[206,210],{"path":203,"langcode":207},{"id":208,"name":209},"en","English",{"path":211,"langcode":212},"\u002Fde\u002Fexpertise\u002Fcybersecurity-consulting\u002Fcyber-defence-services",{"id":213,"name":214},"de","German","Managed cyber defence solutions: every alert in 3 minutes  ",{"processed":217},"\u003Cp>A security analyst investigates every alert within three minutes, not only critical ones. Managed cyber defence for teams without a 24\u002F7 SOC of their own.\u003C\u002Fp>\n",{"id":219,"sharedMediaLegend":220,"mediaImage":221,"name":228},"172972",null,{"url":222,"width":223,"height":224,"alt":225,"title":220,"size":226,"mime":227,"variations":220},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002FComplex_defense_systems_cyber_security_europe.png",800,603,"\"\"",51634,"image\u002Fpng","Complex_defense_systems_cyber_security_europe.png",[230,254,273,283,312,336,363,394,418,424,429,436,464,486],{"__typename":231,"id":232,"columns":233,"listItems":234,"text":251,"title":252,"variant":253},"ParagraphPgContentList","36456","1col",[235,241,246],{"id":236,"icon":220,"link":220,"logo":220,"media":220,"text":237,"title":240},"36453",{"value":238,"processed":238,"format":239},"\u003Cp>Your service runs on CDP, our own sovereign platform, with your data held in Switzerland. You see every incident, investigation and action in real time, and pull your own reports whenever you need them.\u003C\u002Fp>","content_list","Full transparency on our Cyber Defence Platform",{"id":242,"icon":220,"link":220,"logo":220,"media":220,"text":243,"title":245},"36454",{"value":244,"processed":244,"format":239},"\u003Cp>24\u002F7, a qualified security analyst starts investigating within three minutes of an alert being raised. That covers every alert, not only the critical ones, with no severity tiering and no deprioritisation.\u003C\u002Fp>","A qualified security analyst on every alert within three minutes",{"id":247,"icon":220,"link":220,"logo":220,"media":220,"text":248,"title":250},"36455",{"value":249,"processed":249,"format":239},"\u003Cp>Built and run by Zühlke, our team brings an engineering background, so it understands how complex, custom-built and connected systems work, not just their telemetry, so detection fits your environment.\u003C\u002Fp>","Defenders who understand how systems are built","Security that moves at the speed of threats. Full transparency on your own platform, a qualified analyst on every alert within minutes, and defenders who understand how your systems are built.","What you gain with Zühlke Cyber Defence Services","default",{"__typename":231,"id":255,"columns":256,"listItems":257,"text":220,"title":271,"variant":272},"36503","3col",[258,263,267],{"id":259,"icon":220,"link":220,"logo":220,"media":220,"text":260,"title":262},"36500",{"value":261,"processed":261,"format":239},"","Swiss data residency: all your data stays in Switzerland.",{"id":264,"icon":220,"link":220,"logo":220,"media":220,"text":265,"title":266},"36501",{"value":261,"processed":261,"format":239},"ISO 27001 certified.",{"id":268,"icon":220,"link":220,"logo":220,"media":220,"text":269,"title":270},"36502",{"value":261,"processed":261,"format":239},"24\u002F7 security operations, run from Switzerland. ","Swiss, certified, and always on","icon",{"__typename":274,"id":275,"pgTitle":276,"text":277,"link":278,"coloredBackground":7,"compactMode":7,"actionVariant":26,"buttonText":220,"pgEmbededCode":281},"ParagraphPgCtaDefault","36458","What our three-minute service level means","The clock starts when an alert is raised and stops when a qualified security analyst has picked it up and begun investigating. That is under three minutes, 24\u002F7, for every alert rather than only the critical ones. We measure it on every alert, and the figure is visible to you in real time rather than summarised in a monthly report.",{"title":279,"url":280,"internal":7},"Start your 30-day proof of value","#section-34661",{"value":261,"processed":261,"format":282},"code",{"__typename":284,"id":285,"caption":220,"imageRight":204,"pgSharedTitle":286,"pgSharedCtaLink":220,"textMedia":287,"pgSharedText":309},"ParagraphPgTextMedia","36459","Why traditional managed security operations fail to deliver usable, timely responses",{"id":288,"sharedMediaLegend":220,"mediaImage":289,"name":308},"173858",{"url":290,"width":291,"height":292,"alt":293,"title":220,"size":294,"mime":295,"variations":220,"textMediaVariations":296},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002Fcyber-defence_1.jpeg",1015,851,"Person wearing glasses with a computer screen reflected in the lenses",270139,"image\u002Fjpeg",[297,302,303,304,307],{"name":298,"url":299,"width":300,"height":301},"FIXED_WIDTH_SMALL","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffixed_width_small\u002Fpublic\u002Fimages\u002Fcyber-defence_1.jpeg.webp?itok=69KlDeoI",900,755,{"name":298,"url":299,"width":300,"height":301},{"name":298,"url":299,"width":300,"height":301},{"name":305,"url":306,"width":291,"height":292},"FIXED_WIDTH_MEDIUM","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffixed_width_medium\u002Fpublic\u002Fimages\u002Fcyber-defence_1.jpeg.webp?itok=aSIM-RCx",{"name":305,"url":306,"width":291,"height":292},"cyber-defence.jpeg",{"value":310,"processed":310,"format":311},"\u003Cp>If detection isn’t tailored to the environment, rather than achieving actionable clarity the result is just noise. That means false positives, alert fatigue, and delays in taking action, which undermines any cyber resilience strategy. It’s no use taking 8-24 hours to respond to “medium priority” alerts if attackers exploit attack paths and move laterally in minutes. With many conventional SOCs, even after 3-6 months of onboarding, security teams are still unsure whether the service will catch the ONE INCIDENT that matters.\u003C\u002Fp>\u003Cp>Zühlke Cyber Defence Services turn alerts into validated action, fast. Security teams get AI-augmented security operations for speed, plus experienced defenders to ensure confident decision-making. Every alert is dealt with, and performance is visible in real time.\u003C\u002Fp>","full_html",{"__typename":284,"id":313,"caption":220,"imageRight":7,"pgSharedTitle":314,"pgSharedCtaLink":315,"textMedia":316,"pgSharedText":333},"36460","This matters because: ",{"title":279,"url":280,"internal":7},{"id":317,"sharedMediaLegend":220,"mediaImage":318,"name":332},"173859",{"url":319,"width":320,"height":292,"alt":321,"title":220,"size":322,"mime":295,"variations":220,"textMediaVariations":323},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002Fcyber-defence-zuhlke_1.jpeg",978,"Professional IT worker working, coding and machine learning working with AI.",190478,[324,327,328,329,331],{"name":298,"url":325,"width":300,"height":326},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffixed_width_small\u002Fpublic\u002Fimages\u002Fcyber-defence-zuhlke_1.jpeg.webp?itok=VcBHq3U7",783,{"name":298,"url":325,"width":300,"height":326},{"name":298,"url":325,"width":300,"height":326},{"name":305,"url":330,"width":320,"height":292},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffixed_width_medium\u002Fpublic\u002Fimages\u002Fcyber-defence-zuhlke_1.jpeg.webp?itok=xasa1p4s",{"name":305,"url":330,"width":320,"height":292},"cyber-defence-zuhlke.jpeg",{"value":334,"processed":335,"format":311},"\u003Cul>\u003Cli data-list-item-id=\"e1d842c2ecc3ccab2006888782c490162\">Threat responses in under three minutes give attackers little time to spread, and decrease dwell time.\u003C\u002Fli>\u003Cli data-list-item-id=\"e65393b1f83c1faab19c8d6f8781218fa\">Specific detection, proactive threat detection and response highlight real threats and prevent noise.\u003C\u002Fli>\u003Cli data-list-item-id=\"e945b38d913ba6d45bf5be92070f63b29\">Personalised onboarding covers every relevant exposure context in client environments.\u003C\u002Fli>\u003Cli data-list-item-id=\"ed99dbc1024da8dd2b18c2c963feea959\">Transparent reporting makes security control performance easy to verify.\u003C\u002Fli>\u003Cli data-list-item-id=\"e35e6e139cd67bf30d59ff1624d67ad9c\">Deployment within days quickly creates proof of added value.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>With Zühlke, security teams get faster cyber incident response, clearer visibility, and a partner focused on continuous, measurable security posture improvement. \u003C\u002Fp>","\u003Cul>\u003Cli>Threat responses in under three minutes give attackers little time to spread, and decrease dwell time.\u003C\u002Fli>\u003Cli>Specific detection, proactive threat detection and response highlight real threats and prevent noise.\u003C\u002Fli>\u003Cli>Personalised onboarding covers every relevant exposure context in client environments.\u003C\u002Fli>\u003Cli>Transparent reporting makes security control performance easy to verify.\u003C\u002Fli>\u003Cli>Deployment within days quickly creates proof of added value.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>With Zühlke, security teams get faster cyber incident response, clearer visibility, and a partner focused on continuous, measurable security posture improvement. \u003C\u002Fp>",{"__typename":337,"id":338,"title":339,"text":340,"pgCtaLink":220,"imageLayout":341,"media":342},"ParagraphPgTeaserBig","36571","What happens when no one is watching overnight?","Most intrusions begin outside office hours, when a small in-house team is offline. An alert at 2am then waits until morning, and by then an attacker has had hours to move. Zühlke Cyber Defence Services watch your environment around the clock, so a security analyst starts investigating within three minutes, at any hour.","left",{"id":343,"sharedMediaLegend":220,"mediaImage":344,"name":362},"173860",{"url":345,"width":346,"height":347,"alt":348,"title":220,"size":349,"mime":295,"variations":220,"teaserVariations":350},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002Fcyber-defence-after-hours.jpeg",1280,852,"Hand typing on computer keyboard",52980,[351,355,356,360,361],{"name":352,"url":353,"width":223,"height":354},"FOCAL_POINT32_SMALL","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_3_2_small\u002Fpublic\u002Fimages\u002Fcyber-defence-after-hours.jpeg.webp?itok=zK7OTciP",533,{"name":352,"url":353,"width":223,"height":354},{"name":357,"url":358,"width":359,"height":347},"FOCAL_POINT54_MEDIUM","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_5_4_medium\u002Fpublic\u002Fimages\u002Fcyber-defence-after-hours.jpeg.webp?itok=9I65fPlm",1065,{"name":357,"url":358,"width":359,"height":347},{"name":357,"url":358,"width":359,"height":347},"cyber-defence-after-hours.jpeg",{"__typename":231,"id":364,"columns":256,"listItems":365,"text":392,"title":393,"variant":272},"36570",[366,378,385],{"id":367,"icon":368,"link":220,"logo":220,"media":220,"text":375,"title":377},"36567",{"id":369,"sharedMediaLegend":220,"mediaImage":370,"name":374},"172914",{"url":371,"width":372,"height":372,"alt":225,"title":220,"size":373,"mime":227,"variations":220},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002Fdouble-arrow-right-icon.svg__2.png",220,3441,"double-arrow-right-icon.svg_.png",{"value":376,"processed":376,"format":239},"\u003Cp>24 hours to warn, 72 hours to notify, one month to file the final report.\u003C\u002Fp>","NIS2:",{"id":379,"icon":380,"link":220,"logo":220,"media":220,"text":382,"title":384},"36568",{"id":369,"sharedMediaLegend":220,"mediaImage":381,"name":374},{"url":371,"width":372,"height":372,"alt":225,"title":220,"size":373,"mime":227,"variations":220},{"value":383,"processed":383,"format":239},"\u003Cp>24 hours to report a cyberattack to the BACS (since April 2025).\u003C\u002Fp>","Switzerland:",{"id":386,"icon":387,"link":220,"logo":220,"media":220,"text":389,"title":391},"36569",{"id":369,"sharedMediaLegend":220,"mediaImage":388,"name":374},{"url":371,"width":372,"height":372,"alt":225,"title":220,"size":373,"mime":227,"variations":220},{"value":390,"processed":390,"format":239},"\u003Cp>ICT contracts need quantifiable service levels and remedies.\u003C\u002Fp>","DORA Article 30:","Reporting clocks start at awareness, and the first report asks whether an attacker is behind it. That is investigation output, not an alert.\r\nWe start investigating within three minutes of any alert, and you watch each investigation live, so the evidence is yours.","What do NIS2 and DORA require once you become aware of an incident?",{"__typename":395,"id":396,"title":397,"lead":398,"tabs":399},"ParagraphTab","36467","How Zühlke’s managed detection and response services work","Zühlke Cyber Defence Services are designed to protect organisations from day one and continuously improve security posture over time.",[400,409],{"infoText":401,"pgSharedParagraphs":402},"Rapid deployment and early proof",[403],{"id":404,"ctaLink":220,"pgSharedText":405,"pgSharedTitle":408,"pgSharedCtaLink":220},"36463",{"value":406,"processed":407,"format":311},"\u003Cul>\u003Cli data-list-item-id=\"e02e49c69075266af5076364d8e098a0d\">Connect to the security information and event management (SIEM) tooling already in place.\u003C\u002Fli>\u003Cli data-list-item-id=\"ed1a25c0c1f26a1c1317fc3f2688c65e5\">Add tailored and validated detection rules for each environment.\u003C\u002Fli>\u003Cli data-list-item-id=\"e3b7b6555b2c74f07d21b11cac1e6f066\">Set up direct communication channels.\u003C\u002Fli>\u003Cli data-list-item-id=\"ef547c52aa3707774c3167db9b6da8270\">Begin 24\u002F7\u002F365 pre-emptive monitoring with rapid response.\u003C\u002Fli>\u003Cli data-list-item-id=\"e2ff4bc99596bd873405eba814b4ad9ab\">Review measurable and validated results within days.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>Security teams get immediate coverage, clear metrics, and direct access to security experts.\u003Cbr> \u003C\u002Fp>","\u003Cul>\u003Cli>Connect to the security information and event management (SIEM) tooling already in place.\u003C\u002Fli>\u003Cli>Add tailored and validated detection rules for each environment.\u003C\u002Fli>\u003Cli>Set up direct communication channels.\u003C\u002Fli>\u003Cli>Begin 24\u002F7\u002F365 pre-emptive monitoring with rapid response.\u003C\u002Fli>\u003Cli>Review measurable and validated results within days.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>Security teams get immediate coverage, clear metrics, and direct access to security experts.\u003Cbr> \u003C\u002Fp>","Start with rapid deployment and early proof",{"infoText":410,"pgSharedParagraphs":411},"Continuously improve your security posture",[412],{"id":413,"ctaLink":220,"pgSharedText":414,"pgSharedTitle":417,"pgSharedCtaLink":220},"36465",{"value":415,"processed":416,"format":311},"\u003Cul>\u003Cli data-list-item-id=\"e2acdb6e746788b2acb084abeadc73166\">Ongoing detection validation, security operations automation, and tuning to reduce false positives.\u003C\u002Fli>\u003Cli data-list-item-id=\"e29c7b2c090fdb4253fee2b864ae21764\">MITRE ATT&CK® mapping and exposure gap analysis to strengthen cyber security defence.\u003C\u002Fli>\u003Cli data-list-item-id=\"e44ae5aa4345f322e1c5a4b1d4f20512e\">Quarterly business reviews with recommendations.\u003C\u002Fli>\u003Cli data-list-item-id=\"e49277e71dadad178bb866347b23a1968\">Proactive threat detection and threat hunting assessments.\u003C\u002Fli>\u003Cli data-list-item-id=\"e3975848dbe56710951894f8877a73821\">Incident response and forensics support.\u003C\u002Fli>\u003C\u002Ful>","\u003Cul>\u003Cli>Ongoing detection validation, security operations automation, and tuning to reduce false positives.\u003C\u002Fli>\u003Cli>MITRE ATT&CK® mapping and exposure gap analysis to strengthen cyber security defence.\u003C\u002Fli>\u003Cli>Quarterly business reviews with recommendations.\u003C\u002Fli>\u003Cli>Proactive threat detection and threat hunting assessments.\u003C\u002Fli>\u003Cli>Incident response and forensics support.\u003C\u002Fli>\u003C\u002Ful>","Continuously improve your security posture, with no disruption",{"__typename":274,"id":419,"pgTitle":420,"text":421,"link":422,"coloredBackground":204,"compactMode":7,"actionVariant":26,"buttonText":220,"pgEmbededCode":423},"36468","Cyber defence build for tomorrow's threats","As threats and infrastructure change, detections and response stay validated and aligned, building advanced cyber defence systems with full visibility throughout.",{"title":279,"url":280,"internal":7},{"value":261,"processed":261,"format":282},{"__typename":425,"id":426,"ctaLink":220,"pgSharedText":427,"pgSharedTitle":279,"pgSharedCtaLink":220},"ParagraphPgText","36469",{"value":428,"processed":428,"format":311},"\u003Cp>See faster response and full transparency in your own environment, with no procurement process. Complete the form below and our experts will reach out to you shortly.\u003C\u002Fp>",{"__typename":430,"id":431,"pgEmbededCode":432,"fullWidth":204,"edgeToEdge":204},"ParagraphPgCustomCode","36470",{"value":433,"processed":434,"format":435},"\u003Cdiv\r\n        data-form-id='1dd470c5-7632-f111-88b5-6045bd8e204c'\r\n        data-form-api-url='https:\u002F\u002Fpublic-eur.mkt.dynamics.com\u002Fapi\u002Fv1.0\u002Forgs\u002Fa100e546-0f11-ee11-a7ec-000d3aab6a68\u002Flandingpageforms'\r\n        data-cached-form-url='https:\u002F\u002Fassets-eur.mkt.dynamics.com\u002Fa100e546-0f11-ee11-a7ec-000d3aab6a68\u002Fdigitalassets\u002Fforms\u002F1dd470c5-7632-f111-88b5-6045bd8e204c' >\u003C\u002Fdiv>\r\n        \u003Cscript src = 'https:\u002F\u002Fcxppusa1formui01cdnsa01-endpoint.azureedge.net\u002Feur\u002FFormLoader\u002FFormLoader.bundle.js' >\r\ndocument.addEventListener(\"d365mkt-afterformload\", function() {\r\n   \u002F\u002F Function to find input element based on label text\r\n    function findInputByLabelText(labelText) {\r\n      var labels = document.querySelectorAll('label[title=\"' + labelText + '\"]');\r\n      for (var i = 0; i \u003C labels.length; i++) {\r\n        var label = labels[i];\r\n        var inputId = label.getAttribute(\"for\");\r\n        if (inputId) {\r\n          var inputElement = document.getElementById(inputId);\r\n          if (inputElement) {\r\n            return inputElement;\r\n          }\r\n        }\r\n      }\r\n      return null;\r\n    }\r\nfunction populateFormFields() {\r\n    let params = new URLSearchParams(document.location.search);\r\n    let utmSourceField = findInputByLabelText(\"UTM Source\");\r\n    let utmCampaignField = findInputByLabelText(\"UTM Campaign\");\r\n    let utmMediumField = findInputByLabelText(\"UTM Medium\");\r\n    let utmContentField = findInputByLabelText(\"UTM Content\");\r\nif (params.has(\"utm_source\")) {\r\n      utmSourceField.value = params.get(\"utm_source\");\r\n    } else {\r\n      utmSourceField.value = 'N\u002FA';\r\n    }\r\n    \r\n    if (params.has(\"utm_campaign\")) {\r\n      utmCampaignField.value = params.get(\"utm_campaign\");\r\n    } else {\r\n      utmCampaignField.value = 'N\u002FA';\r\n    }\r\n    \r\n    if (params.has(\"utm_medium\")) {\r\n      utmMediumField.value = params.get(\"utm_medium\");\r\n    } else {\r\n      utmMediumField.value = 'N\u002FA';\r\n    }\r\n    \r\n    if (params.has(\"utm_content\")) {\r\n      utmContentField.value = params.get(\"utm_content\");\r\n    } else {\r\n      utmContentField.value = 'N\u002FA';\r\n    }\r\n  }\r\npopulateFormFields();\r\n  console.log(\"d365mkt-afterformload\");\r\n});\r\ndocument.addEventListener(\"d365mkt-afterformsubmit\", function(event) {\r\n  console.log(\"success - \" + event.detail.successful);\r\n  console.log(\"payload - \" + JSON.stringify(event.detail.payload));\r\n});\r\n\u003C\u002Fscript>","\u003Cdiv\n        data-form-id='1dd470c5-7632-f111-88b5-6045bd8e204c'\n        data-form-api-url='https:\u002F\u002Fpublic-eur.mkt.dynamics.com\u002Fapi\u002Fv1.0\u002Forgs\u002Fa100e546-0f11-ee11-a7ec-000d3aab6a68\u002Flandingpageforms'\n        data-cached-form-url='https:\u002F\u002Fassets-eur.mkt.dynamics.com\u002Fa100e546-0f11-ee11-a7ec-000d3aab6a68\u002Fdigitalassets\u002Fforms\u002F1dd470c5-7632-f111-88b5-6045bd8e204c' >\u003C\u002Fdiv>\n        \u003Cscript src = 'https:\u002F\u002Fcxppusa1formui01cdnsa01-endpoint.azureedge.net\u002Feur\u002FFormLoader\u002FFormLoader.bundle.js' >\ndocument.addEventListener(\"d365mkt-afterformload\", function() {\n   \u002F\u002F Function to find input element based on label text\n    function findInputByLabelText(labelText) {\n      var labels = document.querySelectorAll('label[title=\"' + labelText + '\"]');\n      for (var i = 0; i \u003C labels.length; i++) {\n        var label = labels[i];\n        var inputId = label.getAttribute(\"for\");\n        if (inputId) {\n          var inputElement = document.getElementById(inputId);\n          if (inputElement) {\n            return inputElement;\n          }\n        }\n      }\n      return null;\n    }\nfunction populateFormFields() {\n    let params = new URLSearchParams(document.location.search);\n    let utmSourceField = findInputByLabelText(\"UTM Source\");\n    let utmCampaignField = findInputByLabelText(\"UTM Campaign\");\n    let utmMediumField = findInputByLabelText(\"UTM Medium\");\n    let utmContentField = findInputByLabelText(\"UTM Content\");\nif (params.has(\"utm_source\")) {\n      utmSourceField.value = params.get(\"utm_source\");\n    } else {\n      utmSourceField.value = 'N\u002FA';\n    }\n    \n    if (params.has(\"utm_campaign\")) {\n      utmCampaignField.value = params.get(\"utm_campaign\");\n    } else {\n      utmCampaignField.value = 'N\u002FA';\n    }\n    \n    if (params.has(\"utm_medium\")) {\n      utmMediumField.value = params.get(\"utm_medium\");\n    } else {\n      utmMediumField.value = 'N\u002FA';\n    }\n    \n    if (params.has(\"utm_content\")) {\n      utmContentField.value = params.get(\"utm_content\");\n    } else {\n      utmContentField.value = 'N\u002FA';\n    }\n  }\npopulateFormFields();\n  console.log(\"d365mkt-afterformload\");\n});\ndocument.addEventListener(\"d365mkt-afterformsubmit\", function(event) {\n  console.log(\"success - \" + event.detail.successful);\n  console.log(\"payload - \" + JSON.stringify(event.detail.payload));\n});\n\u003C\u002Fscript>","custom_code",{"__typename":437,"id":438,"title":439,"pgContactRefContacts":440,"showEmail":204,"showPhone":204},"ParagraphPgContact","36471","Meet our security experts",[441],{"contactName":442,"contactProfession":443,"contactDesc":444,"contactLinkedinUrl":220,"sharedEmail":220,"sharedPhone":220,"sharedRefMedia":446},"Dr. Raphael Reischuk","Group CTO & Partner",{"value":445},"\u003Cp>Raphael is Group CTO at Zühlke, a doctorate-level cyber security expert and former senior researcher at ETH Zürich. He co-invented the SCION internet architecture, co-founded the Swiss National Test Institute for Cybersecurity (NTC), and sits on the Innovation Council of Innosuisse.\u003C\u002Fp>",{"id":447,"sharedMediaLegend":220,"mediaImage":448,"name":463},"173729",{"url":449,"width":450,"height":450,"alt":451,"title":220,"size":452,"mime":295,"variations":220,"personVariations":453},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002Fraphael-reischuk.jpeg",648,"Raphael Reischuk",94018,[454,457,458,461,462],{"name":455,"url":456,"width":450,"height":450},"FOCAL_POINT11_SMALL","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_1_1_small\u002Fpublic\u002Fimages\u002Fraphael-reischuk.jpeg.webp?itok=Wiigey6e",{"name":455,"url":456,"width":450,"height":450},{"name":459,"url":460,"width":450,"height":450},"FOCAL_POINT11_MEDIUM","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_1_1_medium\u002Fpublic\u002Fimages\u002Fraphael-reischuk.jpeg.webp?itok=wAZBWHeJ",{"name":459,"url":460,"width":450,"height":450},{"name":459,"url":460,"width":450,"height":450},"raphael-reischuk.jpeg",{"__typename":437,"id":465,"title":220,"pgContactRefContacts":466,"showEmail":204,"showPhone":204},"36472",[467],{"contactName":468,"contactProfession":469,"contactDesc":470,"contactLinkedinUrl":220,"sharedEmail":220,"sharedPhone":220,"sharedRefMedia":472},"Pascal Kocher","Cyber Defence Services Lead",{"value":471},"\u003Cp>Pascal is a Principal Consultant for cyber security at Zühlke, with over 30 years in technical security and incident response. He founded DEF CON Switzerland and has served on the boards of ISSS (Information Security Society Switzerland) and the Cloud Security Alliance Switzerland.\u003C\u002Fp>",{"id":473,"sharedMediaLegend":220,"mediaImage":474,"name":485},"173785",{"url":475,"width":450,"height":450,"alt":220,"title":220,"size":476,"mime":295,"variations":220,"personVariations":477},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002F2026_Pascal_Kocher_Zuehlke.jpeg",65831,[478,480,481,483,484],{"name":455,"url":479,"width":450,"height":450},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_1_1_small\u002Fpublic\u002Fimages\u002F2026_Pascal_Kocher_Zuehlke.jpeg.webp?itok=d1fRcAGF",{"name":455,"url":479,"width":450,"height":450},{"name":459,"url":482,"width":450,"height":450},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_1_1_medium\u002Fpublic\u002Fimages\u002F2026_Pascal_Kocher_Zuehlke.jpeg.webp?itok=n_ZQymo7",{"name":459,"url":482,"width":450,"height":450},{"name":459,"url":482,"width":450,"height":450},"2026_Pascal_Kocher_Zuehlke.jpeg",{"__typename":395,"id":487,"title":488,"lead":220,"tabs":489},"36499","Frequently asked questions on Zühlke Cyber Defence Services",[490,497,504,511,518,525,532,539,546,553,560,567,574],{"infoText":491,"pgSharedParagraphs":492},"What does Zühlke's three-minute service level actually mean?",[493],{"id":494,"ctaLink":220,"pgSharedText":495,"pgSharedTitle":491,"pgSharedCtaLink":220},"36473",{"value":496,"processed":496,"format":311},"\u003Cp>The clock starts when an alert is raised and stops when a qualified security analyst has picked it up and begun investigating. That is under three minutes, 24\u002F7, for every alert rather than only the critical ones. We measure it on every alert, and the figure is visible to you in real time rather than summarised in a monthly report.\u003C\u002Fp>",{"infoText":498,"pgSharedParagraphs":499},"What is the 30-day proof of value?",[500],{"id":501,"ctaLink":220,"pgSharedText":502,"pgSharedTitle":498,"pgSharedCtaLink":220},"36475",{"value":503,"processed":503,"format":311},"\u003Cp>The 30-day proof of value deploys Zühlke Cyber Defence Services on your existing SIEM in days, with no procurement process. During the 30 days a security analyst investigates your own alerts to the three-minute service level, and at the end you review validated, measurable results from your environment.\u003C\u002Fp>",{"infoText":505,"pgSharedParagraphs":506},"What SIEMs does Zühlke Cyber Defence Services integrate with?",[507],{"id":508,"ctaLink":220,"pgSharedText":509,"pgSharedTitle":505,"pgSharedCtaLink":220},"36477",{"value":510,"processed":510,"format":311},"\u003Cp>Zühlke Cyber Defence Services integrates with Microsoft Sentinel, Splunk, IBM QRadar, Elastic, and others via our SIEM adapter architecture. For smaller clients, a turnkey solution with Rapid7 SIEM is included.\u003C\u002Fp>",{"infoText":512,"pgSharedParagraphs":513},"How quickly can Zühlke Cyber Defence Services be deployed?",[514],{"id":515,"ctaLink":220,"pgSharedText":516,"pgSharedTitle":512,"pgSharedCtaLink":220},"36479",{"value":517,"processed":517,"format":311},"\u003Cp>Zühlke Cyber Defence Services typically deploy in days to weeks. Typically, it takes days to weeks. Small environments take 3 to 5 days. Medium environments with existing SIEM take 1 to 2 weeks. That’s dramatically faster than the industry standard of 3 to 6 months, so your security team can start improving its security posture almost immediately.\u003C\u002Fp>",{"infoText":519,"pgSharedParagraphs":520},"How does a managed detection and response (MDR) service work?",[521],{"id":522,"ctaLink":220,"pgSharedText":523,"pgSharedTitle":519,"pgSharedCtaLink":220},"36481",{"value":524,"processed":524,"format":311},"\u003Cp>A managed detection and response service combines technology, threat intelligence, and human expertise to detect and respond to cyber threats around the clock. Zühlke Cyber Defence Services goes further, with AI-augmented analysis for speed, an 'assume breach' investigation mindset, and a service level under which a security analyst starts investigating within three minutes of an alert being raised, for every alert rather than only the critical ones.\u003C\u002Fp>",{"infoText":526,"pgSharedParagraphs":527},"What is continuous monitoring in cyber security?",[528],{"id":529,"ctaLink":220,"pgSharedText":530,"pgSharedTitle":526,"pgSharedCtaLink":220},"36483",{"value":531,"processed":531,"format":311},"\u003Cp>Continuous monitoring in cyber security means the environment is watched 24\u002F7\u002F365 for signs of compromise. With Zühlke, this includes real-time alert triage, custom detection rules tuned to any specific infrastructure, and direct communication channels to the defenders, so threats are caught and addressed before they escalate.\u003C\u002Fp>",{"infoText":533,"pgSharedParagraphs":534},"How is AI changing cyber security?",[535],{"id":536,"ctaLink":220,"pgSharedText":537,"pgSharedTitle":533,"pgSharedCtaLink":220},"36485",{"value":538,"processed":538,"format":311},"\u003Cp>AI accelerates threat detection, automates triage, and helps analysts focus on the alerts that genuinely matter. In Zühlke Cyber Defence Services, AI augments human judgement. It handles speed, while experienced defenders handle decisions. The result is faster responses, fewer false positives, and continuous improvement based on real data.\u003C\u002Fp>",{"infoText":540,"pgSharedParagraphs":541},"How can we improve our security posture?",[542],{"id":543,"ctaLink":220,"pgSharedText":544,"pgSharedTitle":540,"pgSharedCtaLink":220},"36487",{"value":545,"processed":545,"format":311},"\u003Cp>Improving security posture starts with visibility, meaning an understanding of your current exposure and gaps in your defences. Zühlke Cyber Defence Services provides MITRE ATT&CK® mapping, quarterly business reviews with practical recommendations, and ongoing detection tuning, so the security posture improves measurably over time.\u003C\u002Fp>",{"infoText":547,"pgSharedParagraphs":548},"What does cyber defence mean?",[549],{"id":550,"ctaLink":220,"pgSharedText":551,"pgSharedTitle":547,"pgSharedCtaLink":220},"36489",{"value":552,"processed":552,"format":311},"\u003Cp>Cyber defence is the combination of people, processes, and technologies an organisation uses to detect, respond to, and recover from cyber threats. It goes beyond prevention, focusing on resilience, continuous security monitoring, and fast incident response.\u003C\u002Fp>",{"infoText":554,"pgSharedParagraphs":555},"Who provides Managed Detection and Response (MDR) for medical device manufacturers?",[556],{"id":557,"ctaLink":220,"pgSharedText":558,"pgSharedTitle":554,"pgSharedCtaLink":220},"36491",{"value":559,"processed":559,"format":311},"\u003Cp>Medical device manufacturers need detection and response that covers both the corporate network and the device itself, because obligations under Medical Device Regulation (MDR) and In Vitro Device Regulation (IVDR) attach to the product. Zühlke engineers design regulated MedTech systems and defend them, so detection is designed from knowledge of how the device was built, not inferred from generic telemetry.\u003C\u002Fp>",{"infoText":561,"pgSharedParagraphs":562},"Which MDR providers keep data in Switzerland?",[563],{"id":564,"ctaLink":220,"pgSharedText":565,"pgSharedTitle":561,"pgSharedCtaLink":220},"36493",{"value":566,"processed":566,"format":311},"\u003Cp>Data residency is a qualifying criterion for many Swiss and DACH buyers. Zühlke Cyber Defence Services keeps monitored data an operations in Switzerland, with ISO 27001.\u003C\u002Fp>",{"infoText":568,"pgSharedParagraphs":569},"What does NIS2 require for detection and response?",[570],{"id":571,"ctaLink":220,"pgSharedText":572,"pgSharedTitle":568,"pgSharedCtaLink":220},"36495",{"value":573,"processed":573,"format":311},"\u003Cp>NIS2 requires in-scope organisations to monitor for, handle and report significant security incidents. Under Article 23 you have 24 hours from becoming aware of a significant incident to send an early warning, 72 hours for a fuller notification, and one month for a final report. Article 21(2)(d) also requires you to assess the quality of your providers' security practices, which means asking them for evidence. The clock starts at awareness, and the first report already asks whether an attacker is behind it, which is the output of an investigation rather than of an alert. Zühlke Cyber Defence Services starts investigating within three minutes of an alert being raised, for every alert rather than only the critical ones, and shows you every investigation and metric in real time, so the account you give is your own.\u003C\u002Fp>",{"infoText":575,"pgSharedParagraphs":576},"Is there Managed Detection and Response (MDR) for OT and industrial environments?",[577],{"id":578,"ctaLink":220,"pgSharedText":579,"pgSharedTitle":575,"pgSharedCtaLink":220},"36497",{"value":580,"processed":580,"format":311},"\u003Cp>Yes. Operational technology and industrial environments need detection tuned to protocols and systems that generic IT detection solutions do not cover. Zühlke engineers connect industrial and safety-critical systems, and CDS operators understand the architecture they monitor and can escalate to the engineers who built it. \u003C\u002Fp>",[582],{"id":583,"name":584},"855","All industries",[586],{"id":587,"name":588},"125","Cybersecurity",{"__typename":590,"id":591,"eyebrow":592,"headerTitleMinimal":593,"intro":594,"media":596,"link":610},"ParagraphPgHeaderSmall","34335","Zühlke Cyber Defence Services","Stop attacks faster with managed cyber defence",{"value":595},"For organisations on custom-built, connected or regulated platforms, where nights and weekends fall to your own small team: Zühlke Cyber Defence Services pair AI-augmented triage with seasoned defenders. A security analyst starts investigating every alert within three minutes, 24\u002F7.",{"id":219,"sharedMediaLegend":220,"mediaImage":597,"name":228},{"url":222,"width":223,"height":224,"alt":225,"title":220,"size":226,"mime":227,"variations":220,"headerMinimalVariations":598},[599,601,602,606,609],{"name":352,"url":600,"width":223,"height":354},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_3_2_small\u002Fpublic\u002Fimages\u002FComplex_defense_systems_cyber_security_europe.png.webp?itok=u4xH71jX",{"name":352,"url":600,"width":223,"height":354},{"name":603,"url":604,"width":223,"height":605},"FOCAL_POINT169_MEDIUM","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_16_9_medium\u002Fpublic\u002Fimages\u002FComplex_defense_systems_cyber_security_europe.png.webp?itok=-KvbBths",450,{"name":607,"url":608,"width":223,"height":605},"FOCAL_POINT169_LARGE","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_16_9_large\u002Fpublic\u002Fimages\u002FComplex_defense_systems_cyber_security_europe.png.webp?itok=X_lojkf4",{"name":607,"url":608,"width":223,"height":605},{"title":279,"url":280,"internal":7}]