Cybersecurity integrator in Bucharest since 2012

Protecting your data is our core business.

We design, deploy, operate and test the security that keeps Romania's most regulated organisations running. One partner for the whole journey, from the first assessment to the incident you hope never comes.

Explore our services Talk to our team

Endpoint securityNetwork securityCloud securityIdentity and accessPrivileged accessEmail securityData protectionSecurity operationsSIEM and SOARIncident responseForensic analysisPenetration testingRed teamingVulnerability management

What brings you here today?

Test my defencesPenetration testing, red teaming and security assessments.See offensive security Handle an incidentDetection, containment, forensics and recovery.See how we respond Meet NIS2 and DORATurn regulatory obligations into a working programme.See compliance Outsource security operationsSOC, monitoring and managed services run by our specialists.See managed services

Trusted where a breach is not an option.

We implement and run critical security for national and international clients, in complex and highly regulated environments.

Banking

Banks that make up 80% of the Romanian banking sector work with us.

0of 5

Utilities and energy

Three of the five most prestigious utilities and oil and gas groups on the Romanian market work with us.

Top0

Insurance

Insurance companies in the CEE region rely on our work.

Global

Telecom

A major player on the international telecom market.

Plus significant enterprises in media, retail, manufacturing and other sectors.

Trust like this is earned by how we choose and build.

Vendor-agnostic by design.

The security market offers an endless list of products, from start-ups to established brands. Our job is to choose what actually fits your risk, integrate it properly and keep it working. We engage with every requirement and stay connected through the whole lifecycle of the project, and beyond it.

We start from your risk

Not from a product list. Architecture follows your exposure, your regulators and the way your people actually work.

We stay for the whole lifecycle

Design, deployment, operation, testing and improvement, with the right technology, service quality and training at every stage.

Certified people do the work

Our specialists keep learning and earning new certifications, so they stay a step ahead of the threats your business faces.

Here is how that approach turns into services.

A security lifecycle, not a shopping list.

Every service protects the same three things.

ConfidentialityOnly the right people see your data.
IntegrityYour data stays accurate and untampered.
AvailabilityYour data is there when the business needs it.

Prevent

Prevention

Harden every way in.

Security architecture and integration
Endpoint security
Network security
Cloud security
Web access and email security
Application security
Identity management
Privileged access management (PAM)
Data protection
Asset inventory and device management
Security awareness for employees

Detect

Detection

See threats while they are still small.

Security Operations Centre (SOC)
Security information and event management (SIEM)
Detection use case development
Infrastructure monitoring

Respond

Response

Contain, investigate, recover.

Incident response (IR)
Security orchestration, automation and response (SOAR)
Forensic analysis
Business continuity management
Crisis simulation for leadership teams

Validate

Assessment and offensive security

Know where you stand, then attack it.

Security assessment
Risk management
Vulnerability management
Penetration testing
Red teaming
Tabletop red teaming

Operate

Managed services

Keep it running, keep it current.

Health check
Break fix
Platform administration and reporting
Patch and version management
Change management
Product training for technical teams

Repeat

Then the cycle starts again.

Every test, alert and incident feeds back into prevention. Threats evolve daily and older ones return more dangerous, so your defences keep improving with them.

Plan your cycle with us

Here is what that lifecycle looks like when something happens.

What detection and response look like from the inside.

Detection only matters if someone acts on it. Our SOC, SIEM and SOAR practice connects the signal to the decision, and our incident response team takes it through to recovery.

1
DetectCorrelated events raise a single, meaningful alert.
2
TriageAn analyst confirms scope and severity.
3
ContainAutomated playbooks isolate what is affected.
4
InvestigateForensic analysis finds the root cause.
5
Recover and reportServices return, lessons feed prevention.

Every incident also has a regulatory side.

Regulation sets the deadline. We turn it into a plan.

Banks, insurers, energy and telecom operators face growing obligations. We bring the assessment, the technology and the operations together, so compliance becomes a working security programme rather than a folder of policies.

NIS2DORACritical infrastructureFinancial services

NIS in a box

A packaged path for organisations that need to meet NIS requirements, combining assessment, controls and ongoing support.

SOC in a box

Security operations capability without building everything from scratch: monitoring, detection use cases and response, delivered as a service.

01
Management accountabilityArt. 20How we helpBoard briefings, management training and leadership crisis simulations
02
Risk analysis and security policiesArt. 21(2)(a)How we helpSecurity assessment, risk management and policy frameworks
03
Incident handling and reportingArt. 21(2)(b), Art. 23How we helpSOC, SIEM and incident response, ready for the 24-hour, 72-hour and one-month reporting deadlines
04
Business continuity and crisis managementArt. 21(2)(c)How we helpBusiness continuity management, backup and recovery planning
05
Supply chain securityArt. 21(2)(d)How we helpThird-party risk management
06
Vulnerability handling and secure developmentArt. 21(2)(e)How we helpVulnerability management, penetration testing and application security
07
Assessing the effectiveness of measuresArt. 21(2)(f)How we helpSecurity audits, penetration testing and red teaming that prove the controls work
08
Cyber hygiene and trainingArt. 21(2)(g)How we helpSecurity awareness for employees and training for technical teams
09
Access control, assets, MFA and encryptionArt. 21(2)(h), (i), (j)How we helpIdentity management, PAM, asset inventory and data protection

Based on the ten cybersecurity risk-management measures in Article 21(2) of Directive (EU) 2022/2555 (NIS2), together with management accountability (Article 20) and incident reporting (Article 23): an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. In Romania, NIS2 is transposed by Government Emergency Ordinance 155/2024, approved by Law 124/2025, and supervised by the National Cyber Security Directorate (DNSC).

Digital operational resilience

01
ICT risk managementCh. II, Art. 5-16How we helpSecurity assessment, risk and vulnerability management, business continuity and board briefings
02
ICT incident management and reportingCh. III, Art. 17-23How we helpSOC, SIEM, SOAR and incident response, with support for classifying and reporting major incidents
03
Digital operational resilience testingCh. IV, Art. 24-27How we helpVulnerability assessments, penetration testing, red teaming and scenario-based exercises
04
ICT third-party riskCh. V, Art. 28-44How we helpThird-party risk management, with continuous supplier monitoring in ThirdSeer
05
Information sharingCh. VI, Art. 45How we helpThreat intelligence and exchange within the security community

Based on Regulation (EU) 2022/2554 (DORA), which has applied since 17 January 2025 to financial entities and sets up an oversight framework for critical ICT third-party providers. In Romania, major ICT-related incidents are reported to the competent authority: the National Bank of Romania (BNR) or the Financial Supervisory Authority (ASF), depending on the type of entity.

For supply chain and ICT third-party requirements, we have also developed ThirdSeer in-house: a platform that monitors the security and compliance status of your suppliers.

None of it works without the people behind it.

24 highlight certifications. One team.

At the core of our success is a team of experts who keep learning and earning new certifications, across governance, offensive security and the platforms we deploy.

Governance, cloud and architecture

6 certifications

CISMISACA
Certified Information Security Manager

CISSPISC2
Certified Information Systems Security Professional

CCSPISC2
Certified Cloud Security Professional

GSLCGIAC
Security Leadership

CNSPCompTIA
Network Security Professional

Cyber ArchitectMicrosoft
Cybersecurity Architect Expert

Offensive security

8 certifications

OSCPOffSec
Certified Professional

OSEPOffSec
Experienced Penetration Tester

OSWEOffSec
Web Expert

OSWPOffSec
Wireless Professional

PNPTTCM Security
Practical Network Penetration Tester

eCPPTINE
Certified Professional Penetration Tester

eWPTXINE
Web App Penetration Tester eXtreme

CEHEC-Council
Certified Ethical Hacker

Defence platforms

10 certifications

NSE 7Fortinet
Network Security Architect

FCSSFortinet
Solution Specialist, Network Security

CCSMCheck Point
Certified Security Master

CCTECheck Point
Troubleshooting Expert

CCFACrowdStrike
Falcon Administrator

CCFRCrowdStrike
Falcon Responder

PAMCyberArk
Defender, Privileged Access

Splunk ES AdminSplunk
Enterprise Security Certified Admin

Splunk Ent. AdminSplunk
Enterprise Certified Admin

Splunk Cloud AdminSplunk
Cloud Certified Admin

Meet the company and the community we bring together.

Built in Bucharest. Trusted across the region.

Data Core Systems was founded in 2012 around one idea: the most important asset of any company is its data. Today we are a cybersecurity integrator for banking, utilities, insurance, telecom and enterprise clients, working from the SkyTower in Bucharest.

2012Founded in Bucharest

SkyTower24th floor, Calea Floreasca

5 sectorsBanking, utilities, insurance, telecom, enterprise

1 lifecyclePrevent, detect, respond, validate, operate

86attendees at an earlier edition147at the latest edition

Every year we bring security leaders, practitioners and global technology partners together in Bucharest for a day of talks, demos and honest conversations about what attackers are doing next.

Next: the 7th edition, 2027 Ask about the 2027 edition

Here is what we have been up to lately.