About
Cybersecurity engineering, from Utrecht.
ITTCsec exists to close the gap between knowing about a security problem and actually having it fixed. We're not a large firm, and we're not trying to sound like one. What we offer is direct engineering expertise applied to your actual environment, not a templated audit.
What we bring together
ITTCsec combines security engineering, cloud and infrastructure security, software security, identity security, cyber risk and AI security, and translates them into practical business protection, not six separate specialisms that don't talk to each other.
Why ITTCsec
Engineering before theatre
We focus on controls that work in real environments, not ones that look complete in a slide deck.
From finding to fix
Assessment is only the beginning. We help implement remediation, not just document what's wrong.
One connected security view
Identity, cloud, software, data and infrastructure are interconnected, and we treat them that way instead of as separate line items.
Security built around the business
Controls have to protect the organisation without unnecessarily stopping it from operating. Security that gets bypassed because it's unworkable isn't security.
Continuous validation
Security isn't complete because a policy or tool exists. Controls need to be tested regularly, not once.
How we work
Security engineering, not security theatre
A report full of findings nobody fixes isn't a security programme. We work through to implementation, not just diagnosis.
Say what we don't know
If something is outside our expertise, we say so and bring in, or point you to, someone who has it. Credibility comes from being right, not from sounding certain.
Plain language, real technical depth
Findings and recommendations should be usable by both the engineer who has to implement them and the executive who has to fund them.
How we write about security
Technical guides and checklists on this site are published under an ITTCsec Security Engineering Team byline. We're a small practice without a dedicated named blogger, and we'd rather be upfront about that than invent an individual persona. Where a piece makes a regulatory or technical claim (a NIS2 obligation, an ISO 27001 requirement), we link the primary source directly rather than asking you to take our summary on faith, and we date when a page was last substantively updated.
Where we operate
Utrecht is home. It's where the practice is based and where clients can meet us in person. The Netherlands is our primary commercial market. From there, we take on engagements across the EU where the work calls for it, particularly where NIS2, GDPR or ISO 27001 obligations span multiple jurisdictions. We don't claim a physical presence beyond Utrecht. EU engagements are delivered remotely, with travel arranged when a workshop or on-site assessment genuinely calls for it.
Van Heuven Goedhartlaan 245, 3527 DK Utrecht, NetherlandsWant to know more about how we'd approach your situation?
Email info@ittcsec.com or follow ITTCsec on LinkedIn. Interested in working here instead? See Careers.