Consulting methodology that became a product.

Starting point

Crisis exercises depended on on-site facilitation: every session tied up consultants, every protocol was written by hand, and nothing remained with the client between exercises. The consultancy wanted to offer its proven exercise methodology as a product of its own — with audit-grade records and clean GDPR documentation, as its clients in regulated industries expect.

Solution

We built a multi-tenant training platform where teams run branching crisis scenarios live: decisions, votes, chat, and a shared whiteboard — in the browser or via VR headset, both in the same exercise. Every exercise automatically produces an audit-grade protocol.

• Branching live scenarios with decisions and votes
• Audit-grade exercise protocol at the push of a button
• AI-assisted scenario authoring for subject-matter experts
• Anonymized, GDPR-compliant KPI reporting
• White-label branding under the consultancy's brand
• Role and permission model with two-factor authentication

Results

Today the consultancy sells crisis exercises as a recurring product: its clients train regularly on the platform, while the consultants focus on methodology instead of logistics. We set up the hosting with a European provider and deliver maintenance, support, and ongoing development from a single source.

• Recurring platform revenue instead of individual workshop dates
• Audit-ready exercise records without manual protocol work
• Complete GDPR documentation as part of the delivery
• Differentiation: an own product under an own brand

Starting point

Regulations such as KRITIS, DORA, and NIS2 demand documented, auditable business impact analyses. In practice they are produced in Excel: countless files, no consistency, painful report assembly. The consultancy — a specialist in exactly this process — wanted to offer its clients a self-service product that directly reflects its methodology instead.

Solution

The platform models the BIA methodology directly: processes with an impact matrix across configurable downtime intervals and damage dimensions, automatically derived criticality tiers, recovery objectives (RTO, MTPD), and a dependency graph that surfaces single points of failure. Campaign workflows orchestrate the assessment across departments.

• One assessment satisfies several standards at once
• Compliance checklists for KRITIS, DORA, and NIS2
• Audit-ready PDF reports and Excel exports at the push of a button
• Campaign workflow with roles, deadlines, and approvals
• Complete audit trail and two-factor authentication
• Strict tenant isolation at the service layer

Results

Excel chaos became a single, structured source of truth. What used to cost consulting days of manual document assembly is now a button: standards-aligned reports generated from live data. Alongside its project business, the consultancy now has a scalable SaaS offering — with self-service signup, team management, and multi-tenancy from day one.

• One source of truth instead of scattered Excel files
• Audit-ready reports without manual preparation
• A scalable product business alongside the consulting work
• Solid answers to every security questionnaire from end clients

Starting point

Most affected companies don't even know whether NIS2 applies to them — let alone how to derive concrete measures from the legal text. The consultancy, at home in ISO 27001 and BSI IT-Grundschutz for over a decade, wanted to productize that knowledge: from applicability check to auditable implementation plan, without requiring a consultant for every step.

Solution

We built a multi-tenant platform covering the full compliance lifecycle. A free applicability check serves as the entry point and feeds sales through a CRM integration. At its core is a parametric requirements library: every requirement is linked to sectors and company sizes and is maintained by the consultants themselves — no developers needed.

• Free applicability check as a measurable lead magnet
• Individual action plans from a central requirements library
• Task board with roles, history, and a complete audit trail
• AI assistant that answers from the actual regulatory texts
• Real-time collaboration across the whole team
• EU hosting and cookieless analytics

Results

A decade of audit experience now lives in a reusable requirements library that serves any number of customers — instead of being re-delivered one engagement at a time. Because every action is logged, audit-ready evidence emerges as a by-product of daily work.

• Consulting knowledge scales as a product instead of billable days
• Measurable acquisition funnel from check to registration
• Regulatory evidence exportable at any time
• AI answers anchored in the real legal texts