And a platform that proves it.
We build security into the architecture, alongside your IT team.
Your IT team stays in charge of its systems. Our focus is Active Directory security and admin tiering. We bring a clean architecture and controls that have held up in real enterprise environments. From that work we have defined three defence pillars we consider essential in modern IT security.
We focus on three areas and cover each one in depth, from design to day-to-day operation.
Control who can become admin, before an attacker enumerates the path.
Segment every host to stop lateral movement at the first hop.
Continuous configuration checks, run by Resonate, our own engine.
Admin credentials are the most valuable target in any environment. We protect them with proven security controls and isolate Tier-0, so a compromised workstation cannot reach domain controllers, PKI or identity infrastructure.
Perimeter firewalls are still necessary, but once an attacker is inside they do little. Host-based firewalling isolates every machine by default. A label-based policy layer turns intent into rules that adjust automatically as the environment changes, and a visualisation layer maps the thousands of flows that never pass a network firewall.
We run curated test and hardening catalogues against your environment on an ongoing basis, rank findings by how far an attacker could get with them and re-test to confirm each fix holds. The engine behind it is Resonate, which we develop ourselves.
Resonate analyses the configuration that decides how far an attacker can move once inside: ACLs, GPO coverage, admin tiering, and AD and Entra hardening, on-premises and in the cloud.
Assess → prioritise → remediate → re-validate. Automated and manual findings in one place, mapped to MITRE ATT&CK and CIS v8, and tracked until they are closed.
ACLs, GPO coverage and admin tiering modelled properly: deny precedence, inheritance scope, allowlists for legitimate defaults. Anyone can dump settings; the hard part is knowing which ones matter.
Read-only checks for the techniques attackers use against AD: Kerberoasting, AS-REP roasting, DCSync, unconstrained and RBCD delegation, SID-history abuse.
Certificate-based domain-takeover coverage, evaluated per template and per CA, with the abusable principals named. Most off-the-shelf scanners don't cover this area.
AD and Entra/Azure hardening in one findings list, covering tenant policy, privileged roles and workload-identity exposure. Cloud access runs through a read-only Graph app that you own and can revoke at any time.
We trace escalation across AD, Entra, PKI, IT infrastructure and client hardening, and rank each finding by the impact an attacker could reach through it.
How Resonate runs: a customer-controlled, agent-based collector · read-only access to AD, GPO & Entra · tiering-aware collection (optional) · the portal is never exposed to the public internet.
There is no account manager in between. You speak to the person who knows your environment.
We work through findings with your team and re-test to show they stay fixed.
Helpdesk, sysadmin, security architect, team lead, MSP: we have run the kind of systems we now secure.
For organisations from around 200 employees up to global enterprises.
We assess Active Directory and the systems attached to it in one day, together with your team.
Analysis and report writing take longer, but happen on our side. Your team's time isn't needed for it.
You receive the full report and a summary with recommendations.
We don't publish client names.
We work with organisations across the sectors below. Our clients hire us for the work, and how they secure their environment stays between us. If you would like to speak to an existing client, we can arrange a reference call under NDA.
Our own evening event in Innsbruck, built around technical talks. Our team covered host-based firewalling, Active Directory hardening, zero trust microsegmentation and the blast radius of a compromised administrator. Partners spoke on attacks against hardened environments, NIS2 and DORA compliance, and containing breaches before they spread. The event was fully booked, and we plan to run it again.
At the 20th-anniversary event of a long-standing IT partner, we spoke on Secure by Design: building controls into the architecture rather than adding them afterwards. Starting from what uncontrolled external access looks like in practice, the talk showed how identity, segmentation and least-privilege design reduce the attack surface to something you can govern.
A three-day workshop at a customer's production site in the DACH region, with nearly 30 participants from across the organisation. Topics: identity protection, network segmentation, vulnerability analysis and real breach scenarios, from how attacks unfold to how they are stopped.
A customer story published by Illumio on how Swacrit secured its manufacturing operations and simplified IT with Illumio zero-trust segmentation, implemented by ROSTECH.
Read the full story on illumio.com →Tell us what you want to protect. An engineer will reply within one working day and walk you through how we would approach it.
robert@rostech.at
Hallerstrasse 133 · 6020 Innsbruck
ROSTECH GmbH
Company registration: FN 658967w
Hallerstrasse 133, 6020 Innsbruck, Austria
VAT-ID: ATU82398727
Business hours: Mon–Thu 09:00–19:00 / Fri 09:00–13:00
Our general terms and conditions apply to all services provided by ROSTECH GmbH.
Copyright: All content on this website is protected by copyright. Reproduction or use without express written permission is not permitted.
Liability: The information provided on this site is for general informational purposes only. No liability is assumed for accuracy, completeness, or content accessible via external links.
Data Protection: This is a read-only website. No input forms, no cookies, no tracking. No personal data is collected or stored when visiting this site. No analytics or tracking software is in use.
GDPR: By contacting or engaging with us, you agree that we store and process personal information (name, email address, phone number, etc.) in our CRM and accounting systems. For full details, see our GDPR statement below.
AI notice: This content was written with a human brain. No language model was harmed in the making of this legal notice.