Security guide
API and API gateway security: a practical guide
How to secure APIs and API gateways: OWASP API Top 10, authentication, authorisation, rate limiting, patching, inventory, testing and response.
CONTENTUM.COM · Insights
Insights
Cybersecurity insights.
Neutral guides to the security topics behind real projects: regulation, testing, hardening and the market. Each guide ends with the next step to a provider who does exactly this.
Buyer guide
Bug bounty and vulnerability disclosure platforms explained
Neutral guide to bug bounty and VDP platforms: programme types, a platform directory, security.txt, EU CRA reporting dates and launch preparation.
Hardening guide
System hardening with CIS Benchmarks: what to know before you start
How CIS Benchmarks work, what Level 1 and Level 2 mean, how to measure compliance and roll out hardening safely, and when to bring in a provider.
Market guide
The DACH cybersecurity market and threat landscape in 2026
Threats, regulation and demand in the DACH cybersecurity market in 2026: BSI, Bitkom and BACS figures, NIS2 status and what buyers and providers should do.
Application security guide
DAST vs SAST: what each finds, what each misses
SAST reads code, DAST attacks the running app. Learn what each misses, where SCA and IAST fit, how to wire them into CI/CD and when you need a pentest.
Compliance guide
ISO 27001 vulnerability management: what control 8.8 expects
How to meet ISO/IEC 27001:2022 control 8.8: scope, related controls, the evidence auditors expect, and where external providers help.
Compliance guide
NIS2 compliance: a practical guide for DACH companies
NIS2 for IT and security leads: who is covered, Article 21 measures, 24/72-hour reporting, status in DE, AT and CH, and a practical start plan.
Framework guide
NIST CSF 2.0 as a Practical Checklist for Your Company
NIST CSF 2.0 as a practical checklist: the six functions, profiles and tiers, mapping to ISO 27001 and NIS2, gap assessment and what to outsource.
Application security guide
The OWASP Top 10 explained: what it is and what to ask providers
The current OWASP Top 10 (2025 edition) in plain words: all ten risks, how to prevent and test them, and what to ask a provider.
Buyer's guide
How to plan and buy a penetration test
What a penetration test is, which types exist, how to scope it, what the report must contain and how to choose a provider. Includes common tools.
Security guide
Vulnerability scanning and vulnerability management explained
How vulnerability scanning works, which scan types and tools exist, how to prioritise with CVSS, EPSS and KEV, and when to use a managed provider.