Cybersecurity Utrecht
Cybersecurity expertise based in Utrecht.
ITTCsec is based in Utrecht, working directly with organisations across the city and the wider Utrecht region, from growing SMEs and scale-ups to established mid-market companies, on the security work that's easier to do well with someone local. If you're searching for an IT security company, cybersecurity consultant or security engineer in Utrecht, this is what working with us actually looks like: technical engineering and practical implementation, not just a report.
Van Heuven Goedhartlaan 245, 3527 DK Utrecht, Netherlands · Get directionsCommon challenges we see locally
A lot of Utrecht organisations we talk to are running a hybrid mix of on-premises infrastructure and Microsoft 365, often without anyone whose full-time job is making sure that combination is configured securely.
Growing NIS2 scope is also pulling in mid-sized organisations that previously assumed regulation like this didn't apply to them. Many are only now working out what it actually requires. See our NIS2 readiness guide for a practical starting point.
And for smaller teams, the gap is often less about tooling and more about not having anyone senior enough to prioritise what to fix first.
Who we work with in Utrecht
SMEs
The most common gap isn't tooling. It's not having anyone senior enough to decide what to fix first. A fractional security lead and a prioritised roadmap usually matter more than another product.
Scale-ups
Security requirements arrive faster than headcount can keep up with: a customer's due-diligence questionnaire, an investor's technical review, or NIS2 scope catching up as you cross a size threshold.
Software & SaaS companies
Customer security questionnaires and SOC 2 or ISO 27001 expectations show up earlier than most SaaS teams plan for. Application security, DevSecOps and cloud configuration are usually the highest-leverage areas.
Professional services
Client data and email compromise are the two risks that matter most. Identity security and Microsoft 365 hardening typically do more than any other single investment.
Healthcare organisations
Legacy systems, connected medical devices, and strict data-protection obligations mean segmentation and access control carry outsized importance relative to a generic checklist.
Financial services
Regulatory obligations compound with the direct financial incentive attackers already have to target this sector, so governance and incident-response readiness both matter more here than average.
Logistics companies
Operational technology and a long tail of third-party integrations create risk that's easy to underestimate until an outage or breach makes the dependency visible.
Technology organisations
Fast-moving engineering teams need security that keeps pace: DevSecOps and application security that fit into an existing pipeline rather than fighting it.
Why work with a security partner based in Utrecht
Being based in the city means an in-person workshop, a tabletop exercise, or a same-week meeting is a short trip, not a flight booking, whether your offices are in the city centre, Papendorp, Rijnsweerd, Leidsche Rijn, or Utrecht Science Park. That proximity matters most in the moments it's hardest to plan for: scoping an incident, walking a board through NIS2 obligations, or getting a technical team and a non-technical stakeholder in the same room to actually agree on priorities.
It also means we're working inside the same Dutch regulatory and business context as the organisations we support: GDPR enforcement by the Autoriteit Persoonsgegevens, NIS2 transposition into Dutch law, and the specific mix of legacy infrastructure and Microsoft 365 that's common across mid-sized Dutch companies, rather than applying a generic international playbook to a Dutch business.
How we work with Utrecht organisations
Most engagements start with a conversation (in person if that's easier for you) about where things actually stand today. From there we typically move through a maturity assessment, into a prioritised roadmap, and then the engineering work to close the highest-risk gaps first. Popular starting points for local clients include Microsoft Security, Cloud Security, Identity & Access Management, penetration testing, and NIS2 and ISO 27001 readiness.
Frequently asked questions
Do you work with small and mid-sized businesses in Utrecht, or only larger organisations?
Both. A lot of our work is with SMEs and scale-ups that need senior security expertise without hiring a full-time CISO, alongside larger organisations bringing in specialist capacity for a specific engagement.
Can we meet in person?
Yes. Utrecht is our home base, and in-person meetings, workshops and tabletop exercises are straightforward to arrange here.
Do you do penetration testing for Utrecht-based companies?
Yes, with written authorisation from the system owner beforehand, as with any engagement. See our Penetration Testing page for scope details.
Can you help with Microsoft 365 and cloud security specifically?
Yes. Microsoft Security and Cloud Security are two of our most common engagements for Utrecht organisations, particularly companies already running Microsoft 365 and Azure who suspect they're under-using the security capability they're already licensed for.
Can you help us prepare for ISO 27001 or NIS2?
Yes. Governance, risk and compliance work covering both is one of our core services, whether you're pursuing ISO 27001 certification, aligning with the standard informally, or working out what NIS2 actually requires of your organisation.
Do you employ a dedicated security engineer we'd be working with, or is this outsourced?
You work directly with the engineers doing the work, not an account manager relaying to someone else. That's a deliberate part of how we operate, not just for Utrecht clients.
How quickly can an engagement start?
It depends on scope, but an initial consultation can typically be scheduled within a few business days. Book a call and we'll confirm timing based on what you need.