E-mail
public[at]samimi.tech

Office
Brandenburgische Str. 38
10707 Berlin

Contact

SAMIMI Tech Consulting · IT & OT Security · Berlin

Detection, response and secure development — engineered to last.

We build SOCs, secure your development and put AI to work. The result is stronger security, automated detection and efficient incident response.

Book a free 30-minute intro callSee how we work

Trusted by operators of critical infrastructure in Germany and the Netherlands

Siemens
Nederlandse Spoorwegen
finanz informatik technologie service
EnBW
Deutsche Bahn
Schwäbisch Hall
Siemens
Nederlandse Spoorwegen
finanz informatik technologie service
EnBW
Deutsche Bahn
Schwäbisch Hall
Siemens
Nederlandse Spoorwegen
finanz informatik technologie service
EnBW
Deutsche Bahn
Schwäbisch Hall

The New Reality

Three problems we see in almost every organisation we work with.

Illustration of three analysts under a wave of alerts while an attack path winds unnoticed through IT, OT and cloud

Operations: when the SOC is drowning

Security tools generate thousands of alerts a day, and the real traces of an attack drown in the noise. Typically, two or three analysts face an APT campaign that has been running for months — reconnaissance, a foothold, patient lateral movement — and the hardest step is recognising that one alert is the visible edge of a coordinated attack. Where IT, OT and cloud are monitored in isolation, attackers move through the blind spots unnoticed. Without precise detection engineering and consistent automation, even the best team loses this fight.

Illustration of a delivery pipeline on which a small vulnerability grows into a costly broken block by the time it reaches production

Development: when security comes too late

Every vulnerability that reaches production costs many times what preventing it in the code would have cost. At the same time, NIS2, the Cyber Resilience Act and supply-chain requirements are raising the pressure: anyone who builds or buys software for critical infrastructure must demonstrate security in the development process, not patch it on afterwards. Most development teams want to build securely. What is missing is not the will, but processes, tooling and knowledge.

Illustration of an attacker automating phishing with AI on one side and a security team under a large question mark on the other, a person in the middle holding the key

AI: between hype and pressure to act

Attackers already use AI for phishing, reconnaissance and attack automation. Defenders are under pressure to respond, but the gap between marketing promises and productive value is wide: which SOC tasks can AI reliably take over today, where are humans indispensable, and how do you integrate AI without creating new risks such as data leakage, hallucinations or compliance gaps? We answer these questions in client projects and have built our own product on what we learned.

Each of these problems has a practical answer. Here is how we approach them.

Our Services

Three services, one principle: we deliver what we would be willing to run ourselves. Every engagement is led by a senior engineer with 5+ years in security, and every solution is built to be efficient and sustainable — it has to keep working, and keep paying off, long after we have left.

Illustration of a security operations center: analysts at screens, alert flows converging into an automated response playbook

SOC, Security Engineering & Automation

Our approach:

  1. Assessment: Analysis of use cases, log sources and alert quality across IT, OT and cloud, with MITRE ATT&CK mapping and coverage analysis.
  2. Detection Engineering: Development and tuning of detections as Detection-as-Code: versioned, tested, documented.
  3. Incident Response & Forensics: Structured response to confirmed incidents, forensic analysis of affected systems, and lessons fed straight back into detections and playbooks.
  4. Automation: SOAR playbooks for triage, enrichment and response. Your analysts work cases instead of tickets.

Your result: A SOC with measurably better detection coverage across all three worlds, fewer false positives and automated first response, with audit-ready documentation.

Illustration of a CI/CD pipeline with security gates checking each build before it moves on

Secure Development

Our approach:

  1. Baseline assessment: Assessment of your development process against established maturity models (e.g. OWASP SAMM), from requirements through the build pipeline to deployment.
  2. Secure SDLC & Threat Modeling: Anchoring security requirements and threat analyses where they are cheapest: before the first line of code.
  3. Pipeline integration: SAST, SCA/dependency scanning, secrets detection and IaC security in the CI/CD pipeline, with meaningful quality gates instead of box-ticking scans whose findings nobody reads.
  4. Vulnerability Management: A process that prioritises, assigns and follows up on findings, including compensating controls for systems that cannot simply be patched.

Your result: A development process in which security is built in rather than bolted on: demonstrable for audits and customer requirements, measurable as fewer findings in production, without slowing down your delivery.

Illustration of an AI model inside a governance ring, with a human hand holding the key

AI in Security: advise, integrate, operate

Our approach:

  1. Use-case identification: A sober assessment of where AI creates real value in your security lifecycle, from vulnerability assessment in development and code analysis to alert triage in the SOC, and where it does not (yet).
  2. Safeguards & governance: Defining data flows, model access, policies and human checkpoints (“human in the loop”).
  3. Integration: Connecting to your existing landscape: SIEM, XDR, SOAR, CI/CD pipeline, ticketing.
  4. Operations & measurement: AI results are measured like any other security function, with clear quality criteria, so that trust is based on numbers rather than marketing promises.

Your result: AI that demonstrably takes work off your security team instead of creating more of it.

Projects

A few examples of what our work looks like in practice. Client names withheld under NDA; references available on request in the intro call.

Illustration of a monitoring dashboard floating above pumps, pipes and control cabinets of an industrial plant

Energy utility · OT Security Operations Center

Challenge
Industrial plant networks without security monitoring, and an environment where every method had to be non-disruptive by design.
What we did
Designed and built an OT SOC in line with IEC 62443 on a passive network-monitoring platform, implemented the monitoring use cases, modelled threat activity against MITRE ATT&CK with current threat intelligence, and set up vulnerability management for industrial systems — CVEs prioritised by exploitability, attack vector and IEC 62443 requirements.
Result
Continuous visibility of the plant networks, prioritised handling of vulnerabilities with the engineering teams, and production that was never touched.
Illustration of a railway control board protected by a shield dome next to rail tracks and signals

Rail automation manufacturer · Secure development for safety-critical OT products

Challenge
Linux-based, safety-critical control systems that have to demonstrate security in the development process under IEC 62443 and the Cyber Resilience Act.
What we did
Integrated SecDevOps into the OT development process, ran threat and risk assessments for PLCs, RTUs, HMIs and IEDs, assessed CVEs down to affected kernel components and automated their filtering and prioritisation, and built the IEC 62443 security platform (IAM, PKI, secure time, remote update) including a host-based IDS for OT/IoT.
Result
A development process with security built in and evidence ready for audits, and a product security platform the engineering teams run themselves.
Illustration of a stream of alerts being enriched by an AI model into case files for an analyst decision

Financial services provider · AI-assisted incident response

Challenge
A SOC drowning in alerts, manual enrichment on every case, and the requirement that no data leaves the company's own environment.
What we did
Designed and built SOAR playbooks for incident response and alert handling, integrated self-hosted open-source LLMs for automated enrichment, contextual analysis and analyst-ready incident summaries, and set up playbook-driven AI triage and prioritisation — transparent, auditable and fully on-premise.
Result
Consistent, faster triage with the analyst keeping the final decision, standardised and documented SOAR processes, and a measurable gain in SOC efficiency.

About us

High-trust delivery for high-risk environments

Where outages threaten the existence of a business, there is no room for experiments. We work strictly to established industry standards and deliver results that stand up to the toughest scrutiny, whether in an in-depth technical review, an official audit or day-to-day live operations.

The founder

Payam Samimi, Founder and Lead Consultant of SAMIMI Tech Consulting

Payam Samimi, Founder and Lead Consultant

Payam has worked in IT and OT security for ten years, seven of them in security operations: building and running SOCs, engineering detections, automating incident response and assessing vulnerabilities in industrial systems — for operators in energy, rail, finance and industry in Germany and the Netherlands. For the same ten years he has followed how AI finds its way into cyber security, and today he builds AI-driven, fully on-premise incident triage himself. He holds a Master’s degree in Computer Science from TU Berlin and OffSec and SANS certifications across offense and defense. He still works hands-on in every engagement.

Certified across offense and defense

Our certifications cover both sides: how attackers break in, and how to detect and respond when they do.

Zertifizierung OSTH
Zertifizierung OSIR
Zertifizierung OSDA
Zertifizierung OSCP+
Zertifizierung OSCP
Zertifizierung GICSP
Zertifizierung OSTH
Zertifizierung OSIR
Zertifizierung OSDA
Zertifizierung OSCP+
Zertifizierung OSCP
Zertifizierung GICSP
Zertifizierung OSTH
Zertifizierung OSIR
Zertifizierung OSDA
Zertifizierung OSCP+
Zertifizierung OSCP
Zertifizierung GICSP
OSCP / OSCP+
Hands-on penetration testing — we know how attacks actually work
OSDA
Defensive analytics: building and tuning detections in a SOC
OSIR
Incident response: investigating and containing live attacks
OSTH
Threat hunting: finding attackers who evaded existing detections
GICSP
Industrial control systems security: the OT standard for engineers

How we deliver

  • Senior-led. Every engagement is led and delivered by a senior engineer with 10+ years of experience — no juniors billed as experts. At the same time we invest in the next generation: juniors learn alongside our seniors on real engagements, and are never billed as something they are not.
  • Non-disruptive by default. Passive methods, agreed change windows, documented tests before anything touches production.
  • Standards-based. MITRE ATT&CK, IEC 62443, OWASP SAMM, NIS2 and CRA requirements, with documentation that passes audits.
  • Measurable. Every project starts with a baseline and ends with numbers you can show your management.
  • Confidential. NDA before the first technical conversation; client data handled under GDPR and never used to train external models.

Before you book

Who are your services for?
Organisations that take security seriously — from mid-sized companies to enterprises and operators of critical infrastructure in energy, rail, transport, financial services and industry. Whether you have an established security team that needs engineering depth, or are building one and need a partner who has done it before, the approach is the same: practical, measurable and built to last.
Do you work on-site or remotely?
Both. Assessments and OT work usually include on-site phases; detection engineering and pipeline work are mostly remote. We are based in Berlin and travel worldwide.
What happens in the 30-minute intro call?
You describe where you stand and what you want to achieve. We tell you, without a pitch, whether we are the right fit and what a first step would look like. If we are not the right fit, we say so and point you elsewhere.
Which languages do you work in?
German and English, including all documentation.

Contact

Let’s talk about your security.

In a free 30-minute intro call we discuss where you stand, what you want to achieve and whether, and how, we can support you. No sales pitch, no obligation.

Book a free 30-minute intro call

Not ready for a call? Send us a short description of your situation — your alert volume, your SOC setup or your development pipeline — and we will reply within two working days with a frank assessment of whether we can help.

Or reach us directly: public[at]samimi.tech · +49 30 84519978

confidential · structured · on equal footing