CypSec-Validato Joint Venture

Mansfeld-Südharz, Germany - October 1, 2025

How two mid-European scale-ups fused engineering depth with compliance DNA without merging balance sheets

A joint venture is usually described as a strong agreement between multiple organizations, but the legal entity that sits at the centre of the Cyber Resilience Alliance feels more like a tandem bicycle built for the Alps: one pedal is labelled "engineering", the other "compliance", and both riders must keep cadence or the whole outfit stalls on the first uphill curve. The bicycle was assembled in October 2025 when CypSec and Validato contributed their respective expertise to a newly formed security initiative.

CypSec added more than fourteen autonomous software modules to the Cyber Resilience Alliance, including its fuzzing engine, deception orchestrator, policy-as-code compiler and sovereign-identity fabric, representing a total of over 1.8 million lines of code that had previously lived inside CypSec's software core. Validato transferred a thinner but deeper layer: many years of algorithmic know-how in human-risk scoring, privacy-preserving analyses and audit-grade human risk management tracking, all originally built to satisfy Swiss banking regulators. The distinction is important: CypSec contributes software artefacts anyone can containerise, and Validato contributes artefacts people can compile into human risk management decision trees. Validato greatly improves the entropy estimator used to detect forged CVs, while CypSec hardens the cybersecurity posture for third-party organizations.

Governance is where the tandem bicycle becomes visible. Day-to-day power sits in a steering committee. Any resolution that affects data-sovereignty principles, such as hosting location, key-management jurisdiction or third-country data transfer, requires a qualified majority. The same committee approves the threat-intelligence sharing charter, a living document that lists which log fields may be exported, which must be hashed, and which must remain on domestic soil.

The joint venture sells managed services in a federation. Each client signs a standardised contract that bundles three elements: access to the shared security operations center, a voucher package for consulting services, and a licence to deploy the combined software stack in a sovereign private cloud. The pricing is scaled to employee count and fit inside the IT security budget of a Mittelstand firm yet high enough to fund the ongoing R&D pool.

"The Cyber Resilience Alliance is merging assurances: engineering assurance on one side, and audit assurance on the other"

What this structure produces in practice is a venture that behaves like an independent security standard with cash-flow. Engineering velocity is high because the IP is already pooled; compliance velocity is equally high because Validato's audit DNA is baked into every pull request; and public trust is high because the county can block any single party from chasing growth at the expense of sovereignty. Early indicators of success, such as 1.4 million shared IOCs or zero lost packets so far, suggest the tandem bicycle is not only climbing the hill but picking up speed on every pedal stroke.

The Cyber Resilience Alliance is a public-private partnership established 2025, led by CypSec, Validato and the County of Mansfeld-Südharz. The Alliance operates a sovereign private-cloud security stack, a shared SOC and an cyber academy, aiming to make Mansfeld-Südharz the reference site for rural cyber resilience by 2030.

Media Contact: Daria Fediay, Chief Executive Officer at CypSec - daria.fediay@cypsec.de.