# SKOPION

> SKOPION (Skopion Intelligence) — Secure Software Engineering, Application Security and Cybersecurity for companies and organisations. SKOPION designs, develops, integrates, tests, hardens, deploys and documents web applications, portals, APIs and custom software in DE/PL/EN, remote from Mönchengladbach and across the EU.

## What SKOPION does
SKOPION makes the digital attack surface of a company visible — email, domains, DNS, accounts, public exposure and brand — frames the resulting Geschäftsrisiken (business risks), and prioritises concrete measures. The focus is Prävention (prevention) and risk transparency, focused on business-risk visibility rather than isolated tool checks. Work is defensive, based on publicly available and authorised information, and human-in-the-loop. In acute incidents SKOPION provides structured support as a fallback. For companies, agencies, Mittelstand, e-commerce, practices, law and tax firms, property managers, suppliers, and public-sector organisations — not limited to small businesses.

## Services (engineering, prevention & Germany-wide B2B subcontracting)
- Nationwide B2B Technical Subcontracting (Technischer Subunternehmer — Germany-wide / DACH / EU) — SKOPION takes on clearly scoped technical work packages for IT system houses (Systemhäuser), software and digital agencies, NIS2/CRA/ISO consultancies, and prime contractors across Germany, DACH, and the EU (full-stack web/API development, code review, penetration testing, remediation & retesting, and EU CRA / SBOM verification).
- EU Consortium & R&D Work-Package Partner (EU PIC 861665939, SME status) — presented at the German-Belgian-French NKCS / NCC-DE matchmaking for Digital Europe / ECCC Call DIGITAL-ECCC-2027-DEPLOY-CYBER-11-AI4SME (AI for SMEs) and available for Horizon Europe Cluster 3, Digital Europe ECCC, EuroHPC, and national R&D consortia as a focused SME technology and evaluation work-package partner (seeking experienced consortium coordinators and consortium partners; registration and matchmaking participation do not imply an awarded grant or endorsement).
- Secure Software Engineering — full-stack web applications, portals, APIs, systems integration, custom plugins, software modernisation, secure architecture, code review, remediation and retesting.
- Sicherheits-Check / Risikoprüfung — structured assessment of the visible attack surface with prioritised measures.
- Exposure / digitale Angriffsfläche — what is publicly visible: email, domains, DNS, accounts, brand.
- E-Mail, Domain, DNS & Phishing readiness — SPF/DKIM/DMARC hardening and phishing resilience.
- Markenmissbrauch & Phishing-Frühwarnung — early signals on lookalike domains, fake shops and brand abuse.
- Dark-Web Exposure Check — whether credentials or the brand circulate online (one signal, not the identity).
- KI-Sicherheitscheck — security review for chatbots, AI assistants and document-based workflows.
- KI-Sicherheitscheck für Kinder und Jugendliche — authorised behavioural and governance assessment for AI offerings used by children or young people (restricted non-red-line pilot by prior agreement and technical pre-check; no certification, no legal advice, no confirmation of compliance).
- Awareness / Readiness / Notfallplan — staff awareness, backup/restore readiness and incident-plan basics.
- OSINT-Recherche — structured analysis of publicly available signals around an exposure or incident.
- Verschlüsselung & sichere Kommunikation — end-to-end encryption, PGP and secure communication channels.
- Incident support (fallback) — structured initial assessment after account takeover, fraud or a suspected incident.
- Krypto-Spurensuche / Wallet-Risikoanalyse (niche) — structuring of publicly traceable blockchain signals.
- Penetration Testing & Application Security — authorised security assessments of web apps, APIs and infrastructure.

## Methodik (prevention loop)
1. Secure first contact & scope.
2. Exposure & risk assessment — passive, without interfering with third-party systems.
3. Framing the business risks — evidence over gut feeling.
4. Prioritised measures & implementation.
5. Readiness & recurring review.
6. Acute incident support as a fallback.

## Boundaries
Defensive work only, on publicly available and explicitly authorised sources. No unauthorised access or testing of third-party systems, no legal advice, no guarantees of success, recovery or takedown, no claim of completeness.

## Key pages
- https://skopion.de/de — home (German, default); /en and /pl available
- https://skopion.de/de/leistungen — services (EN /services, PL /uslugi)
- https://skopion.de/de/secure-softwareentwicklung — secure software development (same slug under /en and /pl)
- https://skopion.de/de/penetrationstest — penetration testing (EN /penetration-testing, PL /testy-penetracyjne)
- https://skopion.de/de/methodik — how we work (EN /methodology, PL /metodyka)
- https://skopion.de/de/lagebilder — prevention & risk scenarios (EN /scenarios, PL /scenariusze)
- https://skopion.de/de/cyber-lage — curated advisories from official public sources
- https://skopion.de/de/cyber-kalender — NRW holidays, school holidays and IT-security planning windows
- https://skopion.de/de/forschung-innovation — research & innovation / methodology
  - SKOPION Verdict v15.0 Native-Sovereign — Sovereign Decision AI R&D Programme (Apache-2.0, 4B/9B/27B, Edge-INT8, Pico-INT4 & Committee, 56 benchmark suites / 16,140 evaluations per model across 95 evaluated model variants; #1 on 54-suite external head-to-head with 94.95% Strict-54, 94.95% Strict-52-Verified, 93.42% Strict-46, 100.0% Wave-11 & Wave-12 KRITIS / Sovereign-Grid (3,900/3,900), and 99.97% 35-suite position consistency on SKOPION Verdict 27B v15.0 vs. 94.86% SKOPION Committee v15.0, 94.26% baselabs/mammoth-1 27B, 94.25% SKOPION Verdict 9B v15.0, 94.04% SKOPION Verdict 4B v15.0 BF16 / 94.02% Edge-INT8 / 93.97% Pico-INT4 at 1.88 J/decision, 93.50% Remek/basal-omni-1.0-ultra 31B, 91.57% autotrust-jev-27b-v1.1, and 74.63% SpeakLeash/Bielik-11B-v3.0-Instruct; 9 EU/NATO languages DE/PL/EN/FR/UK/NL/CS/ES/IT/RO, Post-Quantum NIST FIPS 203/204/205 receipts, IEC 62443 / NIS2 / EU CRA / EU AI Act Annex III & IV / DORA TLPT / CER / 5G O-RAN / ENISA EUCC / HL7 FHIR / CycloneDX / SPDX / OpenVEX / STANAG 4774, Decision Index 0.4 compatible engine): https://skopion.de/de/forschung-innovation/skopion-verdict-ki-forschungsprogramm (EN https://skopion.de/en/research-innovation/skopion-verdict-ai-research-program, PL https://skopion.de/pl/badania-innowacje/program-badawczy-ai-skopion-verdict)
  - Sovereign AI Security Node R1 — 180-Day On-Premises Sovereign AI & Security Reference Architecture: https://skopion.de/de/forschung-innovation/sovereign-ai-security-node (EN https://skopion.de/en/research-innovation/sovereign-ai-security-node, PL https://skopion.de/pl/badania-innowacje/sovereign-ai-security-node)
- https://skopion.de/de/cra-readiness — EU Cyber Resilience Act (CRA, Reg. 2024/2847) Readiness, SBOM (CycloneDX v1.6 / SPDX v3.0 / OpenVEX) & Art. 14 ENISA 24h/72h Vulnerability Reporting (EN /en/cra-readiness, PL /pl/gotowosc-cra)
- https://skopion.de/de/nis2-readiness — NIS2 Readiness & Incident Plan Assessment (EN /en/nis2-readiness, PL /pl/gotowosc-nis2)
- https://skopion.de/de/ai-act-readiness — EU AI Act (Reg. 2024/1689) Readiness & Risk Classification (EN /en/ai-act-readiness, PL /pl/gotowosc-ai-act)
- https://skopion.de/de/it-sicherheitscheck — Structured IT Security Check for SMEs (EN /en/it-security-check, PL /pl/audyt-bezpieczenstwa-it)
- https://skopion.de/de/it-sicherheit-moenchengladbach — Local Hub: Cybersecurity, Penetration Testing & AppSec for Mönchengladbach, Niederrhein & NRW (EN /en/it-security-moenchengladbach, PL /pl/bezpieczenstwo-it-moenchengladbach)
- Featured guide — IT Security Grants NRW & MID-Digitale Sicherheit (NRW.BANK 2026: 50% funding up to 15,000 EUR for SMEs): https://skopion.de/de/ratgeber/it-sicherheit-foerderung-nrw-mid (EN https://skopion.de/en/guides/it-security-grants-nrw-mid, PL https://skopion.de/pl/poradnik/dotacje-bezpieczenstwo-it-nrw-mid)
- https://skopion.de/de/vertrauen — trust & security posture
- https://skopion.de/de/wissen — knowledge base; https://skopion.de/de/ratgeber — guides
- https://skopion.de/de/fallstudien — 12 case studies of real fraud & phishing cases we analysed (detect→analyse→attribute→report), DE/EN/PL (EN /case-studies, PL /studia-przypadku)
  - Fake-Shop-Cluster & Ad-Cloaking (2,200+ SHOPOEM/oemsaas domains behind social ads): https://skopion.de/de/fallstudien/fake-shop-cluster-ad-cloaking-analyse
  - Kleinanzeigen phishing (share.google redirect + cloaking): https://skopion.de/de/fallstudien/kleinanzeigen-phishing-fallstudie
  - Fake car dealer, domain resurrection after a TV report: https://skopion.de/de/fallstudien/fake-autohaendler-verkaufsbetrug
  - Crypto wallet-drainer (malicious signature request): https://skopion.de/de/fallstudien/krypto-wallet-drainer
  - Brand & domain monitoring (lookalike/phishing early detection): https://skopion.de/de/fallstudien/marken-domain-monitoring
  - Advance-payment supplier fraud, B2B: https://skopion.de/de/fallstudien/b2b-lieferbetrug
- Full case-study & guide content for AI ingestion: https://skopion.de/llms-full.txt
- Featured guide — Infostealer & credential exposure: https://skopion.de/de/ratgeber/infostealer-zugangsdaten-leak (EN https://skopion.de/en/guides/infostealers-credential-leak, PL https://skopion.de/pl/poradnik/infostealery-wyciek-hasel)
- https://skopion.de/de/fuer-kommunen — for public sector

## Languages & coverage
German, Polish, English. Mönchengladbach · Nordrhein-Westfalen · Germany · EU (remote).

## Contact
- Secure contact form: https://skopion.de/de#contact (EN https://skopion.de/en#contact, PL https://skopion.de/pl#contact)
- Encrypted contact (PGP): https://skopion.de/de/pgp
- Phone / WhatsApp / Signal: +49 176 503 459 60