Patrick, what motivated you to write a book on IT security for small and medium-sized businesses right now?

Patrick: In my day-to-day work at ASTRUM IT, I see that many small and medium-sized businesses still believe they are “too small” to be targeted by attackers. The opposite is true: SMEs in particular often lack clear structures and emergency plans. With this book, I want to show that cybersecurity is an existential management issue. It’s about understanding where liability risks lurk and how to build true digital resilience through pragmatic steps. That’s exactly what we implement every day in projects at ASTRUM IT.

You say: “IT security isn’t a project, but a mindset.” What does that mean in the day-to-day operations of a company?

Patrick: Sustainable IT security only works if it’s conceived as an ongoing process: clear responsibilities, recurring audits, and emergency plans that are tested time and again. This means that risk analyses or backup tests are firmly integrated into the annual cycle. At ASTRUM IT, we support this with structured IT security audits and cybersecurity consulting, while always keeping a close eye on the current threat landscape and regulatory developments.

How do you specifically view ASTRUM IT’s role for small and medium-sized businesses?

Patrick: ASTRUM IT supports companies from analysis through to operational implementation: We identify which systems are business-critical and where vulnerabilities lie. This ranges from managed services to disaster recovery plans. We explicitly do not see ourselves as NIS 2 consultants and do not actively offer this type of consulting. Our focus is on operational IT. However, as a responsible partner, it is our duty to protect our clients: If we notice vulnerabilities in day-to-day operations that are relevant to NIS 2, for example, we proactively point out this potential for improvement. If questions arise, we then support our clients on a case-by-case basis and to the best of our ability.

In your experience, in which areas do small and medium-sized businesses most often underestimate the risks?

Patrick: A major issue is preparing for emergencies. Many companies have backups, but rarely test how quickly they can actually get back up and running. Another risk is a lack of security awareness. At ASTRUM IT, we lead by example and rely on intensive awareness initiatives as well as technical safeguards for our own employees to ensure that our team remains part of a robust security chain. We incorporate this internal experience into our general consulting for clients to raise awareness of human risk factors there as well.

What are the three measures that business owners should tackle first today?

Patrick: First, an honest assessment of business-critical systems is needed. Building on that, tested backup strategies and clear responsibilities should be established. As a third step, I recommend an external perspective, such as through an IT security audit. Here, operational requirements—as also stipulated by the NIS 2 Directive—are naturally incorporated into our work, as we always take a holistic view of security.

What is your key message to small and medium-sized businesses?

Patrick: Today, IT security is key to a company’s long-term viability. It must be understood as an integral part of the corporate culture and treated by management as a leadership priority. Investing in IT security today strengthens a company’s ability to innovate and compete.

Thank you very much, Patrick, for the interview!

It’s time to act fast! Make your company resilient against digital threats. For more information about our services, please visit our Webseite.

About the Author

Author: Patrick Fabisz
Title: “Digital Total Collapse – Why IT Security Is Not an IT Project, but a Survival Strategy for Small and Medium-Sized Businesses”
Publication Date: April 1, 2026
Available on Amazon

Laura, why did ASTRUM IT focus on the topic of accessibility?

Laura: In software development, accessibility is no longer just a “nice-to-have”—it’s a fundamental necessity. Especially with our

VISIT is a software platform designed for visitor and yard management—a product used daily by many different user groups. We want to ensure that absolutely everyone can use it. The workshop is intended to help us build a shared understanding within the team and familiarize ourselves with the technical and legal foundations.

Dominik, what made this workshop special?

Dominik: Our speaker, Simon, made the topic incredibly accessible. He is blind himself, works as a developer and tester, and showed us how he uses a Braille display or a screen reader. The live demonstration was particularly impressive, as the concrete example made it clear just how important good structuring, alternative text, and logical navigation are for the user experience when using assistive technologies.

Laura, you tested your own product, VISIT, for accessibility. How did that go?

Laura: This made the topic not just theoretical, but very concrete and tangible. Simon tested our product, VISIT, focusing in particular on the online check-in and the web UI. This allowed us to see in real time which elements are easily accessible, where there are still obstacles, and how initial improvements could be implemented.

Dominik: What was particularly interesting was that not only we, but also major providers, still face challenges when it comes to accessibility. This showed us that creating accessible software is an ongoing process that must be continually reviewed and improved.

What insights did you take away from the workshop?

Laura: A key “aha” moment came from using screen readers. For the first time, participants gained a real understanding of how blind people use software—for example, how they navigate through content, make sense of a page, and orient themselves. It also became clear how quickly and efficiently these tools can be used, but at the same time, how quickly one reaches their limits when content is not cleanly structured or technically marked up correctly.

Dominik: The shift in perspective was particularly striking: elements that are visually present for sighted users sometimes play a completely different role for screen reader users, while seemingly incidental content suddenly becomes central. A lack of semantic structure, unrecognizable interactions, or insufficient markup were thus experienced as real barriers—for example, when menus are not recognizable as such or headings have not been technically marked up correctly. This experience was complemented by direct dialogue with a person affected by these issues. The opportunity to ask questions and learn firsthand how digital barriers impact daily life was perceived as particularly valuable.

What’s next for ASTRUM IT?

Laura: This topic remains firmly on our agenda. Going forward, we want to pay closer attention to accessibility right from the concept phase and develop guidelines for our projects.

Dominik: We also want to share our knowledge within the team and perhaps help other projects at ASTRUM IT become more accessible.

Finally: What advice do you have for other development teams?

Dominik: Treat accessibility as an integral part of your development process, not as an extra task. Even small adjustments can have a big impact.

Laura: And bring in expertise early on. Workshops like this one are eye-opening—literally.

Conclusion

The workshop with Simon reminded us once again that accessibility is a central component of modern software development and goes far beyond technical details. For our VISIT team, the event provided important inspiration for making digital products even more inclusive, understandable, and accessible in the future.

Question: How has your daily routine as a programmer changed since AI tools like GitHub Copilot or ChatGPT have become part of your workflow?

Paul: My daily work as a programmer has changed significantly thanks to AI tools like GitHub Copilot. I’m able to come up with initial working solutions more quickly and find it easier to get started with new topics. At the same time, using these tools constantly exposes me to new concepts that go beyond AI. It’s now also part of my routine to continuously optimize my workflow and integrate new features of AI tools in a meaningful way.

Question: In your opinion, which skills will be more important for developers in the future: traditional programming knowledge or proficiency with AI tools?

Paul: Traditional programming knowledge will remain essential in the future as well, since it goes far beyond simply writing code. I think using AI tools will become easier and easier, and soon won’t be any more challenging than doing research online. Nevertheless, a solid foundation in programming remains indispensable.

Question: How do you handle issues like code quality and accountability when AI suggests or automatically generates code?

Paul: When using AI-generated code, it’s tempting to rely on suggestions that work without scrutinizing them in detail. That’s why thorough code reviews, where you explain your own code line by line, are particularly important. Responsibility for code quality always remains with the developer, regardless of which tools were used.

Question: Do you see AI more as a support tool or as potential competition for developers?

Paul: I currently see AI primarily as a support tool for developers. While AI tools can already handle many tasks, they often reach their limits when it comes to complex requirements or integration into existing systems. In-depth human expertise is still required here. The industry is undergoing a transformation, and I believe that the scope of developers’ work will change significantly in the future. Whether AI is perceived as support or competition is ultimately a personal matter.

Question: What advice would you give to young programmers entering an industry today that is rapidly changing due to AI?

Paul: My advice to young programmers is to first build a solid foundation of knowledge without relying on AI tools. This will make it easier to understand and evaluate code later on. AI can help identify and fill gaps in understanding, but it shouldn’t be used as an autopilot. It’s important to analyze errors in the code and understand the underlying reasons.

Question: How does ASTRUM IT specifically use AI in software development, and what experiences have you gained so far?

Paul: At ASTRUM IT, the use of AI depends heavily on the specific development team. Applications range from simple questions about frameworks and writing unit tests to specialized, specification-driven development in smaller projects.

Question: Is there an AI tool or technology that you would particularly recommend to other developers, and why?

Paul: We’re currently using GitHub Copilot, and I recommend taking full advantage of this tool’s wide range of features. When used correctly, Copilot can significantly speed up work and make the use of premium models more efficient.

Thank you very much for the interview, Paul!

AI is no longer just a trend; it has become an integral part of modern software development. However, developers’ sense of responsibility remains crucial, because intelligent tools do not replace a deep understanding—they enhance it.

ASTRUM IT has received the TOP Partner Mittelstand 2026 award in the “IT Service Provider for SMEs” category. The award is based on an independent survey of corporate clients conducted by Markt und Mittelstand and Q-Ranks. Service providers from across Germany were evaluated according to key criteria such as service quality, value for money, and willingness to recommend. For ASTRUM IT, the result is a clear signal from the market: customers and partners confirm that the company’s commitment makes a lasting impression.

In the “IT Service Provider for SMEs” category, ASTRUM IT achieved above-average results in all three performance areas—service quality, value for money, and willingness to recommend. This award confirms what is lived out in everyday work: innovative approaches, a strong team spirit, and a passion for reliable IT services. Whether in software development, hosting, with the VISIT product, or in research projects, ASTRUM IT shapes the digital future of small and medium-sized businesses together with and for its customers and partners.

The “TOP Partner for SMEs 2026” ranking is designed to be a practical assessment from the perspective of corporate clients. It evaluates the specific value that service providers deliver in day-to-day business, how reliably they operate, and how fair the collaboration is perceived to be. The fact that ASTRUM IT scores so highly in terms of recommendations shows that customer satisfaction extends far beyond individual projects and reflects a long-term, trusting partnership. For small and medium-sized enterprises that rely on stable, secure, and scalable IT solutions, this award sends an important signal.

A big thank you goes out to the entire ASTRUM IT team. The award as a TOP Partner for SMEs would not have been possible without the commitment, passion, and strong team spirit of our employees. They are the reason why ASTRUM IT impresses day after day with high-quality service, reliable solutions, and innovative ideas. The honor is therefore both recognition and motivation to continue driving the digital transformation in the SME sector with a close relationship with our customers and a clear focus on quality and fairness.

How does ASTRUM IT’s VISIT visitor and yard management system support compliance with KRITIS and NIS-2?

Daniel Tripp: “Our VISIT software platform plays a central role in securely managing physical access and visitor flows in sensitive areas. In KRITIS environments, it is essential to precisely control access rights and track who was on site and when. This significantly improves security controls. This enables companies and government agencies to prevent unauthorized access and, in an emergency, quickly determine whether security protocols were followed. In addition, VISIT automates approval processes, verifies identification documents, and provides self-service terminals for efficient check-in. This prevents unauthorized access and ensures transparent documentation.”

What is ASTRUM IT’s focus in the area of hosting and IT operations for KRITIS compliance?

Daniel Tantinger: “Through our hosting and IT operations, we ensure that critical IT systems remain highly available, secure, and monitored. This includes redundant infrastructure, continuous monitoring, and rapid response capabilities in the event of security incidents. For KRITIS and NIS 2 operators, it is crucial that their systems not only remain secure but also operate stably and reliably, as any downtime can have serious consequences. Through our close partnership with noris network, one of Germany’s leading providers of highly secure data centers, we offer state-of-the-art infrastructure, industry-specific security concepts, and the highest certification standards (including ISO/IEC 27001). Data is processed in German high-security data centers and protected by multi-layered security systems as well as geographically redundant backups. This ensures that even critical applications remain reliably available and compliant with legal requirements.”

How does ASTRUM IT support information security and ISO 27001?

Christoph Weber: “Information security is at the heart of every KRITIS compliance program. We assist with the implementation and maintenance of ISO 27001-certified management systems that systematically identify and minimize risks. ISO 27001 certification ensures that security processes are not only documented but also actively implemented. A must for operators of critical infrastructure!”

What added value does the combination of these skills offer at ASTRUM IT?

Daniel Tripp: “The integration of physical visitor management, secure IT operations, and a robust information security management system creates a comprehensive security architecture.”

Daniel Tantinger: „“This enables us to offer our customers highly secure services and provide tailored solutions that meet their specific needs.”

Christoph Weber: “It provides operators of critical infrastructure with the necessary security in an ever-changing threat landscape.”

In a nutshell: What advice do you have for decision-makers in industry and government agencies?

Daniel Tripp: “Use modern tools like VISIT to address physical security vulnerabilities.”

Daniel Tantinger: “Choose professional hosting and IT operations services that minimize the risk of downtime.”

Christoph Weber: “And be sure to systematically expand your information security management system in accordance with ISO 27001—it’s well worth the effort.”

Conclusion: KRITIS and NIS-2 as an opportunity to strengthen your IT resilience

On November 13, the German Bundestag passed the national NIS2 Implementation Act. Now, more than ever, it is time to analyze risks and define areas for action. With ASTRUM IT, you have an experienced partner at your side who will guide you safely through the complex requirements, step by step. Rely on certified IT security solutions and sustainably increase the cyber resilience of your company or government agency.

Want to know if you’re affected? Simply check the BSI website, answer a few simple questions, and get a clear assessment right away.

If you have any questions about KRITIS and NIS-2, please feel free to contact us!

Further information is also available on our website and in our Video!

What are your thoughts on the role of AI in everyday business operations?

Gerhard: “AI is no longer just a topic for the future; it is already having a significant impact on our daily work. It boosts our efficiency, opens up new business opportunities, and helps us implement innovative solutions more quickly. At the same time, the adoption of AI raises ethical questions and entails a responsibility to provide ongoing training for our employees. For me, therefore, striking a balance between technological progress and humanity is the key to success.”

How exactly is ASTRUM IT shaping the digital transformation?

Gerhard: „We believe in closely integrating technology with corporate culture. Only when employees feel trusted and have the freedom to act can they reach their full potential and drive innovation. In this context, digital leadership skills are particularly important to me. In today’s world, it is essential that leaders not only understand technological developments but also possess the ability to digitally lead and motivate their teams and actively guide them through change. For me, being a digital leader means acting with empathy and adaptability, recognizing individual needs in an increasingly hybrid and technology-driven work environment, and fostering communication and collaboration. I see this competency as one of the most important prerequisites for the success of digitalization and transformation and for providing employees with the best possible support.”

What does it mean to be a leader today?

Gerhard: “For me, leadership today means acting as a bridge-builder—between technology and people, between strategy and implementation. We live in a world that is constantly changing. This makes it all the more important for us as leaders to inspire others, boldly break new ground, and at the same time create an environment where mistakes can be made and lessons learned from them.”

In addition to technological challenges, Gerhard also sees the social responsibility of IT companies taking center stage: “Sustainability, diversity, and respectful collaboration are now integral parts of how we operate.”

What personally motivates you in your role as CEO of ASTRUM IT?

Gerhard: “I am a small business owner through and through. Small businesses have a special strength—you can see that every day here. What motivates me most is that, by working together, we create tangible value for both our customers and our employees. For me, it’s not just about today, but about sustainable growth and a culture where innovation and humanity go hand in hand.”

Question: How are you tackling the current challenges of digital transformation?

Gerhard: “Digital vitality is a key priority for us. It’s not just about technical innovation, but about the ability to continually reinvent ourselves and respond to change with agility. The combination of experience and fresh thinking is crucial in this regard. We create a space where creative ideas can flourish and foster a corporate culture that encourages experimentation and facilitates the exchange of knowledge. This ensures that we don’t just keep up—we lead the way with our solutions.”

Question: How important is a strong corporate culture to you?

Gerhard: “Corporate culture isn’t just a nice-to-have; it’s the foundation of sustainable success. Openness, appreciation, and trust are the pillars of our culture. At ASTRUM IT, we prioritize transparent communication and a strong sense of community where every employee can thrive and contribute their ideas. For us, diversity and mutual respect aren’t just buzzwords—they’re values we live by every day.”

Question: How do you see the role of AI in day-to-day operations at ASTRUM IT, particularly with regard to our research projects?

Gerhard: “AI is no longer an experiment, but an integral part of our daily lives and our strategic direction. Our current research projects are intensively focused on the responsible use of artificial intelligence. In doing so, we develop solutions that not only automate and optimize processes, but also enhance human capabilities and enable innovation—from intelligent assistance systems to data-driven decision-making processes. We place particular importance on translating research into practical applications so that our employees and customers can benefit from the latest findings. This also includes promoting continuing education so that everyone can actively shape technological change.”

Is there anything else you’d like to add by way of summary?

Gerhard: “For me, digital transformation isn’t a one-time project, but an ongoing mindset: digital vitality. It’s about constantly rethinking things with curiosity and courage, using the right technologies responsibly, and above all, empowering people to succeed together. At ASTRUM IT, we combine technological innovation with a culture that fosters trust, respect, and development. In this way, we aim not only to be successful today, but also to shape the IT solutions of tomorrow and bring our employees along with us on this journey.”

Thank you for the interview, Gerhard!

ISO 27001 in the Development Process – Security from the Start

Information security is not a one-time task, but an integral and urgently needed part of our development process. As part of our ISO 27001 implementation, we have therefore integrated a risk assessment based on the OWASP Top 10[1] directly into our workflow.

• In our planning process, we identify and document security risks even before development begins
• As soon as risks are identified, we assess their criticality using the Common Vulnerability Scoring System (CVSS). This internationally recognized standard allows us to prioritize security risks objectively and transparently. This ensures that particularly critical vulnerabilities are addressed quickly—before they can impact our systems and, consequently, our customers.
• Through automated penetration tests, our software is scanned daily for potential security gaps and vulnerabilities.
• Third-party software we use also undergoes a daily, automated security check provided and verified by public authorities.

In this way, we maintain a software development process that prioritizes security awareness on a daily basis and is continuously expanded and put into practice.

ISO 9001 in the Development Process: Quality Through Clear Definitions and Processes

Implementing ISO 9001 in software development means not only adhering to quality standards, but also integrating them consistently and as seamlessly as possible into daily work processes. A key tool in this process is the Definition of Done (DoD), which ensures that tasks are not considered complete until all relevant quality guidelines have been met.

In the development process, tasks are not simply declared “done.” Instead, the Definition of Done specifies which steps are absolutely necessary to ensure quality. These include, among others:

• Code review: Every change to the software is thoroughly reviewed and approved by several software developers before the next steps are initiated.
• Issue Review: During a second review cycle, we verify that the functionality, documentation, automated tests, and test descriptions have been implemented in the best possible way for further development before they are handed over to the testing department for functional quality assurance.
• Documentation of risk management measures: Identified qualitative risks and how they are managed are described in a proactive and transparent manner and, where necessary, are subject to separate reviews.
• Implementation guidelines: Relevant information and procedures for implementing specific requirements are documented in detail to ensure traceability and knowledge transfer.

These requirements are not merely theoretical guidelines; they are enforced and documented using our Jira software. This provides transparent evidence that processes are being followed.

Structured Approach to Bugs

In addition to the Definition of Done, there is a clearly defined process for handling bugs in the software. This includes:

• Analysis and assessment of the bug
• Decision on (partial) software lockdowns, if necessary
• Transparent communication to customers regarding impacts and measures

This structured approach ensures that not only are bugs fixed, but transparency, trust, and reliability toward customers are also maintained.

Conclusion

ISO 9001 (Quality Management) and ISO 27001 (Information Security Management) together provide a foundation for robust, resilient supply chains. While ISO 9001 standardizes processes and institutionalizes knowledge within the organization, ISO 27001 ensures that information and data remain protected throughout the supply chain. The result is greater transparency, trust, and quality—not only internally but also in collaboration with customers, partners, and suppliers.

For more information about our certifications, please visit our Website.

[1] The OWASP Top 10 is a list of the ten most critical security risks for web applications, compiled by the Open Web Application Security Project (OWASP). It serves as a guide for developers, security experts, and organizations to identify and address the most common and dangerous vulnerabilities in web applications.

Podcasts bring people together and create valuable added value for businesses

Podcasts have long been more than just a trend; they are a fantastic medium that provides companies with lasting support in connecting with their target audience. We have already completed two exciting podcast projects: one in 2021 with Bürobesuch.de and another in September with the marketing agency smic.

Our 2021 podcast with Bürobesuch.de focused on ASTRUM IT as a company. In conversation with our Managing Director Gerhard Pölz, the focus was primarily on what defines ASTRUM IT: the combination of digital innovation, custom software development, and long-term partnerships with clients in sectors such as medical technology, public administration, and industry. Values such as responsibility, employee-centricity, and sustainable organic growth played a central role. The interview offers an authentic insight into our corporate philosophy and expert IT services.

Our latest podcast project with smic just went live in September 2025. In this episode, we discuss current topics such as IT, digitalization, artificial intelligence, as well as our portfolio and exciting projects.

For us as an IT service provider, the podcast offers an ideal platform to share our expertise, shed light on innovative technologies, and showcase our capabilities.

How a podcast helps a business

Podcasts open up new communication opportunities for businesses:

Personal connection: Podcasts allow for authentic storytelling and conversations, helping to build an emotional connection.
Brand building: Through regular episodes, a company positions itself as an expert and builds trust with its target audience.
Reach and diversity: Audio formats reach audiences who read less and prefer to listen—for example, while commuting or exercising.
Versatile content: Podcasts provide content that can also be repurposed for blog posts, social media, or newsletters, strengthening your content strategy.
New customer contacts: Podcasts create touchpoints with potential customers without intrusive advertising, which makes customer acquisition easier.

For us, podcasts are a key component of modern corporate communication: We use them to share knowledge, increase visibility, and make new connections.

If you’d like to listen to our podcast episodes:

UYou can listen to our Bürobesuch.de podcast episode here.

You can find our episode of the smic! it up podcast here.

Mathias, the shortage of skilled workers has been an issue for many years. How is ASTRUM IT addressing this?

Mathias:“We take this seriously, but we won’t let it paralyze us. Our approach is to remain visible, honest, and committed. Especially in a tight job market, how you present yourself as an employer is crucial. We focus on an applicant management process that is transparent, fast, and human. No ‘hire and fire,’ no endless processes, but rather a clear dialogue on equal terms. This is the only way to achieve sustainable recruiting, which is reflected in our very low turnover rate compared to the industry average.”

What sets your recruiting process apart from that of other companies?

Mathias: “Many applicants tell us that they hear nothing from other companies for weeks or receive no feedback at all. That’s a no-go for us. Whenever possible, we respond promptly, are approachable, and provide honest feedback. Our reviews on kununu reflect this. Our communication and the appreciation shown throughout the process are particularly praised.”

How important is the issue of cultural fit in this context?

Mathias:“Extremely important. Professional qualifications are one thing, but whether someone is truly a good fit for us is often decided on a different level. We’re looking for people who share our values, enjoy working together, and want to grow professionally. For us, that’s more sustainable than any short-term hire.”

What lessons have you learned over the past few years?

Mathias: “A few things have proven particularly effective for us:

Clear messaging: Who we are and what we stand for must be evident at first glance, whether on the website, in job postings, or during interviews.
Speed matters: Quick feedback and short decision-making processes make a huge difference.
People-first approach: We don’t view applicants as “resources,” but as individuals with potential.
Feedback culture: Even when things don’t work out. We give honest, constructive feedback. That’s appreciated.”

And your personal takeaway?

Mathias: “Recruiting isn’t a sprint, but a dialogue. Those who listen, communicate honestly, and demonstrate integrity will find the right people even in times of a skills shortage. We’ve seen this firsthand, and we’re staying the course.”

Thank you very much for the interview, Mathias!