Kevin, what are some of the tasks you handle in your day-to-day work?

Kevin: My focus is on service delivery management and the further development of our service processes. At the same time, however, I remain actively involved in the support business. This allows me to stay in touch with the day-to-day challenges our customers face. This combination helps me not only improve processes in theory, but also refine them based on concrete experiences from day-to-day operations.

You’ve introduced a new support standard. What prompted this change?

Kevin: Today, our customers expect clear processes, fast response times, and transparency. That’s why we analyzed and refined our existing workflows. The goal was to establish clear lines of responsibility, standardize communication channels, and make collaboration between customers, support, and operations even more efficient.

What benefits does this bring to customers?

Kevin: Above all, customers benefit from greater transparency and accountability. They always know who their point of contact is, what the current status of their request is, and what the next steps are. At the same time, we can prioritize requests more quickly and handle them in a more targeted manner.

Does working in support help you in your role as Service Delivery Manager?

Kevin: Definitely. If you want to improve service quality, you should experience the daily challenges firsthand. By working on tickets and customer inquiries, I get a direct sense of where processes are working well and where there’s still room for improvement. That fosters understanding on both sides—for our customers and for our team.

What challenges do you encounter most frequently?

Kevin:Kevin: Every customer works differently and has different requirements. The challenge is to establish consistent standards while remaining flexible enough to accommodate individual needs.

What motivates you in your work?

Kevin: I’m especially motivated when customers feel that we understand their needs and are actively working on improvements. It’s great to see how a support request can lead to long-term optimizations that make our customers’ day-to-day work easier.

Thank you very much for the interview!

For many organizations, the question is not so much whether to use AI, but rather how to do so in a way that is legally compliant, secure, and cost-effective. This is precisely where the greatest challenges lie: a lack of transparency regarding the AI systems in use, unclear responsibilities, insufficient documentation, or uncertainties regarding data protection and IT security. In our new blog post, you’ll learn about the impact of the EU AI Act on businesses and why a structured approach to AI is more important today than ever before.

The First Step: Clarity on Your Own AI Landscape

Before regulatory requirements can be implemented, a complete overview of existing AI applications is necessary. This includes not only in-house solutions but also AI features in off-the-shelf software, chatbots, copilots, and analytics tools.

A structured inventory helps to

• identify the AI systems in use,
• assess risks,
• define responsibilities,
• identify documentation requirements, and
• detect potential compliance gaps early on.

From Analysis to Sustainable AI Governance

The AI Act makes it clear that AI cannot be viewed in isolation as a technology. Companies need processes that support the entire lifecycle of an AI application.

These include, among other things:

• risk assessment,
• the definition of governance structures,
• the integration of data protection and security requirements,
• the documentation of decisions, and
• raising awareness and training employees.

Robust AI governance will become a critical success factor, especially for companies that wish to integrate AI more deeply into their business processes in the future.

Harnessing the Potential of AI While Keeping Compliance in Mind

Regulatory requirements are often perceived as an obstacle. In reality, however, they can help lay a solid foundation for AI projects. Defining risks, responsibilities, and processes early on creates the conditions for the long-term successful use of AI.

A pragmatic approach is key here: Regulatory requirements must be made understandable, adapted to the specific circumstances of each company, and integrated with existing IT and compliance processes. This avoids creating additional administrative burdens and instead establishes a structured framework for the secure use of new technologies.

At the same time, the issue of data sovereignty is increasingly coming into focus. In light of the EU AI Act and other regulatory requirements, many companies and public institutions are critically examining where AI applications are operated and which legal frameworks apply to the processing of sensitive data. Particularly with regard to AI services from U.S. providers and hyperscalers such as AWS, Microsoft Azure, or Google Cloud, many organizations are asking how European compliance, data protection, and governance requirements can be met in a transparent and sustainable manner over the long term.

Controlled data management in Germany or the European Union is becoming increasingly important, particularly in regulated industries, within the KRITIS framework, and when implementing NIS 2 requirements. This enables companies to reduce risks, increase transparency regarding their data, and more easily comply with regulatory requirements. Choosing an appropriate AI and hosting strategy is thus increasingly becoming a key component of sustainable AI governance.

Support on the Path to AI Act Readiness

Companies benefit greatly from a partner who understands both the regulatory requirements and the technical and organizational challenges.

These include, for example:

• analyzing the existing AI landscape,
• assessing potential risks,
• developing AI governance frameworks,
• integrating compliance requirements into existing processes,
• evaluating the technology behind new AI solutions, and
• providing guidance on implementing specific measures.

In this way, the AI Act becomes not a barrier to innovation, but a framework for establishing AI in the company in a controlled, secure, and future-proof manner.

Setting the Right Course Now

The EU AI Act is much more than just a new regulation. It is an opportunity to take a strategic look at the use of artificial intelligence and shape it for the long term.

Those who establish transparency, build governance structures, and systematically assess risks today are laying the foundation for the successful and trustworthy use of AI.

Would you like to know how your company can prepare for the requirements of the EU AI Act? Talk to our experts about a practical strategy for AI governance, compliance, and the secure use of AI.

At ASTRUM IT, we therefore view hosting not as an isolated server operation, but as part of a robust operational and security architecture. Our focus is on solutions tailored to each company’s specific needs—from the stable operation of individual applications to managed platforms for growth-oriented or regulated business models.

In short: Modern hosting combines availability, security, transparency, and operational responsibility—so that companies can reliably continue to develop their digital offerings.

Why Hosting Is a Competitive Factor Today

• Availability and performance directly influence customer experience, productivity, and revenue.
• Security and data protection are now expectations, not value-added services.
• Scalability determines whether digital services can grow quickly or tap into new segments.
• Infrastructure is becoming increasingly relevant for compliance, auditability, and resilience.
• Clear operational processes reduce risks and build trust—both internally and externally.

For companies, this means that hosting is no longer just a cost center but a cornerstone of their digital strategy. Those who establish clear technical and organizational frameworks early on can adapt to new requirements more quickly and operate more sustainably.

Typical Challenges with Traditional Hosting

• Unclear operational responsibilities: Who responds to outages, security alerts, or capacity bottlenecks?
• Lack of transparency regarding costs, maintenance, updates, and support services.
• Rigid infrastructures that are difficult to scale in response to growth or project changes.
• Security strategies that do not consistently evolve to meet new requirements.
• High internal overhead for monitoring, patches, backups, documentation, and compliance reporting.

These issues often lead to delays, additional costs, and unnecessary risks—especially when applications are business-critical or industry-specific requirements must be addressed.

What Modern Hosting Must Deliver

• Stability and Availability: Systems must remain reliable even during peak loads, maintenance windows, or technical disruptions.
• Security from the Start: Protection against attacks, data loss, and misconfiguration begins with architecture, operations, and continuous maintenance.
• Scalability: Infrastructure should be able to grow with requirements—technically, organizationally, and economically.
• Transparency: Clear roles, documented processes, transparent communication, and measurable service levels provide planning certainty.
• Relief for internal teams: Operational tasks are handled in a structured manner, allowing internal IT resources to focus more on technical expertise and further development.

Modern hosting, therefore, is not solely focused on technology, but on the company’s goals: stability, operational flexibility, and reliability during day-to-day operations.

Managed Hosting: Why It’s Worth It

• Operations, monitoring, updates, and backup and security processes are not left to chance, but are planned and implemented in a structured manner.
• Customers are assigned clear points of contact, defined service levels, and transparent communication.
• The environment can adapt to requirements—rather than having to adapt business processes to a rigid infrastructure.
• Industry-specific requirements, such as those related to data protection, information security, or auditing, can be addressed early on.

Managed hosting is therefore not merely an operational service, but a partnership model. The goal is to clearly allocate responsibility, reduce risks, and manage technical complexity in a way that ensures companies remain capable of taking action.

When is a hosting partner like ASTRUM IT a good fit?

• Your systems are critical to customers, employees, or business processes.
• You have heightened security, data protection, or compliance requirements.
• You want to reduce the workload on your internal IT teams without losing control or transparency.
• You need scalable infrastructure for new applications, platforms, or digital business models.
• You’re looking for a partner that doesn’t separate operations, communication, and responsibility.

It is precisely in these cases that managed hosting is often the better choice compared to basic “raw hosting” or fully in-house operations. ASTRUM IT can provide support here for companies that prioritize a practical, secure, and transparent operating environment.

How ASTRUM IT Can Help

• Customized hosting solutions tailored to the application, security requirements, growth, and operating model.
• Managed hosting with defined responsibilities, service levels, and recurring operational processes.
• Operational security measures, monitoring, patching and backup strategies, as well as structured communication in the event of an outage.
• Close coordination with internal IT teams, line-of-business departments, and project managers.
• Sustainable implementation that not only works in the short term but remains viable in the long term.

This results in infrastructure that is not only technically deployed but also functions effectively in day-to-day operations: reliable, transparent, and tailored to the company.

For which companies is this particularly interesting?

Professional hosting is particularly relevant for companies that are expanding digital services, processing sensitive data, or seeking to tap into new markets. These include, for example, software providers, regulated industries, manufacturing companies with digital platforms, service providers with customer-critical portals, or organizations that want to gradually professionalize their IT.

Getting started doesn’t always have to involve a large-scale project. Often, the added value begins with a thorough analysis of the existing environment, clearly defined operational boundaries, and a realistic vision for security, availability, and scalability.

Conclusion

Modern hosting operations are far more than just “providing servers.” They align availability, security, scalability, and accountability with a company’s business objectives. Those who prioritize clarity, professional operational processes, and the right partner early on gain planning certainty and reduce risks.

For many companies, managed hosting is therefore not just a technical solution, but an important step toward a robust, future-proof infrastructure—and a solid foundation for the secure further development of digital offerings.

Would you like to determine which hosting model is right for your applications? ASTRUM IT can help you structure your requirements and develop a viable solution for operations, security, and growth.

Modernizing existing software is therefore a strategic priority for many companies. It allows them to preserve proven business logic while adapting technologies, architecture, and the user experience to current requirements.

But what exactly does software modernization mean, when does it make sense, and what role does artificial intelligence play in it?

What Is Software Modernization?

Software modernization refers to the technical and functional enhancement of existing applications to ensure their future viability. The goal is to adapt existing systems to current requirements in terms of technology, security, performance, and user-friendliness.

Modernization can take various forms:

• Updating outdated technologies and frameworks
• Migrating to cloud or hybrid environments
• Modernizing user interfaces
• Optimizing software architecture
• Integrating new interfaces and services
• Improving security, maintainability, and scalability

Unlike a complete new development, modernization involves the targeted reuse of existing knowledge, business logic, and proven processes.

Risks of Outdated Software

Many companies put off modernization projects for years. The consequences often don’t become apparent until problems arise in day-to-day operations.

Typical risks of outdated software include:

Security vulnerabilities and compliance risks

Technologies that are no longer supported often no longer receive security updates. This increases the risk of cyberattacks, data loss, and violations of regulatory requirements.

Rising Maintenance Costs

The older an application gets, the more costly it becomes to maintain. Specialists for outdated technologies are hard to find, and making changes often requires a disproportionately high amount of effort.

Limited Capacity for Innovation

New business models, digital services, or AI applications are often difficult to integrate into outdated system landscapes.

Poor User Experience

Outdated user interfaces and slow processes hinder acceptance among employees and customers.

Technical Dependencies

Outdated software often leads to so-called “legacy dependencies,” which slow down other digital transformation projects.

The Right Time for Modernization

Not every legacy application needs to be replaced immediately. However, there are clear signs that indicate when modernization makes sense:

• The technologies in use are no longer supported.
• Maintenance and operating costs are rising steadily.
• New requirements can only be implemented with significant effort.
• Security or compliance requirements can no longer be met.
• The application does not scale sufficiently with the company’s growth.
• Interfaces to modern systems are missing or cause problems.
• The user experience no longer meets users’ expectations.

The sooner companies recognize these signs, the greater their flexibility in planning a cost-effective modernization.

Photo from ThisisEngineering at Unsplash.

Modernizing Legacy Systems: The Biggest Challenge for Many Companies

In practice, software modernization often involves so-called legacy systems. These are applications that have been in productive use for many years or even decades and support core business processes.

Especially in sectors such as manufacturing, medical technology, and public administration, these systems are deeply integrated into business operations. They contain valuable business logic, established processes, and often business-critical know-how.

At the same time, legacy systems are frequently affected by technological obsolescence. Outdated programming languages, missing interfaces, limited scalability, or rising maintenance costs hinder further development and increase dependence on a small number of specialists.

The challenge, therefore, is to combine the best of both worlds: proven business logic and existing investments should be preserved, while technology, architecture, and user experience are brought up to modern standards.

Successful legacy modernization does not necessarily mean completely replacing a system. Often, a phased approach is more cost-effective and carries less risk.

Possible measures include:

• Refactoring existing applications
• Modernizing the user interface
• Migrating to current technologies and frameworks
• Implementing modern APIs and integration layers
• Breaking down monolithic applications into services
• Migrating to cloud or hybrid environments

The specific process of such a modernization project depends on the technical and business requirements of the respective system.

How Does Software Modernization Work?

Successful modernization begins with a thorough analysis and follows a structured approach.

1. Assessment

First, the architecture, technologies, interfaces, data structures, and business processes are analyzed. The goal is to gain a comprehensive understanding of the existing application.

2. Evaluation and Goal Definition

Next, an evaluation is conducted to determine which components should be modernized, migrated, or, if necessary, replaced. Technical, economic, and organizational goals are defined during this process.

3. Developing a Modernization Strategy

A customized roadmap is created based on the requirements. This roadmap may call for a phased modernization or a comprehensive transformation.

4. Implementation

The modernization is carried out in clearly defined work packages. Iterative approaches help minimize risks and ensure that initial improvements can be put to use early on.

5. Operation and Further Development

Once a system is deployed, continuous development begins. Modern applications are regularly updated, monitored, and adapted to new requirements.

A structured quality and security process plays a central role, particularly in regulated industries such as medical technology or public administration.

AI in Software Modernization

As part of software modernization, AI can support both technical and organizational processes:

Analysis of Existing Systems

AI can analyze large codebases, recognize patterns, and identify potential vulnerabilities.

Support for Migration

Modern AI tools help document and transform source code, as well as highlight technical debt.

Test Automation

AI-powered testing methods support quality assurance and reduce manual effort.

Intelligent Features in Modernized Applications

As part of a modernization effort, new AI features can be integrated, such as:

• intelligent search functions
• document analysis
• process automation
• predictive models
• user assistance systems

However, it’s important to note that AI is no substitute for a well-thought-out modernization strategy. It is merely a tool that can support and accelerate projects.

New Development or Refactoring: Which Is the Right Approach?

One of the most common questions is: Should the existing software be modernized or completely redeveloped?

There is no one-size-fits-all answer.

Arguments in favor of modernization:

• valuable existing business logic
• stable core processes
• limited budget
• lower project risk
• shorter implementation times

Arguments in favor of a new development:

• severely outdated architecture
• high technical debt
• lack of scalability
• fundamental changes to business processes

In practice, hybrid approaches often emerge, in which individual components are newly developed and others are specifically modernized.

The right decision is always based on a technical and economic assessment of the initial situation.

Benefits of Software Modernization

Successful modernization offers companies numerous advantages:

• greater IT security
• better maintainability
• lower operating costs
• greater scalability
• better user experience
• faster implementation of new requirements
• improved integration capabilities
• greater future-proofing

Furthermore, modern software lays the foundation for digital innovations and the use of new technologies such as cloud services or artificial intelligence.

Modernization as the Foundation for Digital Vitality

Software modernization is far more than a technical update. It is a strategic investment in a company’s future viability.

The key to success lies not in viewing existing systems in isolation, but in evaluating technology, processes, security, and long-term business goals together. This reduces the risks associated with outdated software while simultaneously unlocking new potential.

As a partner for customized software solutions, ASTRUM IT supports companies in analyzing, modernizing, and further developing their applications. The focus is not on replacement at any cost, but rather on how existing systems can be adapted to meet future requirements in a cost-effective, secure, and sustainable manner—from consulting and software development to hosting and operation on German, GDPR-compliant infrastructures.

For companies, this often means that business units want to digitize processes, IT is expected to deliver modern solutions, and at the same time, security, data protection, and audit requirements must not be overlooked.

In our latest blog post, we highlight what customers need to consider when developing software for regulated industries.

Why Regulated Industries Have Unique Requirements

• Different requirements depending on the industry, market, and operating environment.
• High standards for traceability, security, and documentation.
• Little room for error, as mistakes can become costly during operations, audits, or the approval process.

This is precisely why off-the-shelf software is often insufficient. Customers need solutions that map their business processes while also fully adhering to the regulatory framework.

The Most Common Pitfalls in Projects

• Unclear requirements between business units, IT, and compliance.
• Involving security, data protection, and quality assurance too late in the process.
• Missing or incomplete documentation.
• Off-the-shelf software does not fit the specific processes.
• Interfaces, data flows, and access permissions are underestimated.

For customers, this quickly leads to delays, additional costs, and unnecessary coordination loops. The situation becomes particularly critical when technical decisions are not reviewed until large parts of the project have already been implemented.

Image source: compagnons

What Customers Really Need

• A partner who takes regulatory frameworks into account from the very beginning.
• Transparent communication among all project participants.
• Software architectures that are secure, maintainable, and scalable.
• Solutions that are tailored to actual processes, not the other way around.
• Reliable documentation for internal approvals, audits, and future enhancements.

Customers aren’t just looking for a service provider—they’re looking for a partner who understands their environment and places technical decisions within a robust project context.

Why Experience Is a True USP

Especially when it comes to software for regulated industries, companies should rely on long-standing expertise. Those who have been developing solutions for demanding, compliance-driven environments for many years are familiar not only with the technical requirements but also with industry-specific pitfalls, typical audit questions, and expectations regarding security, traceability, and documentation.

This experience is a clear USP. It helps customers reduce risks, set up projects properly, and arrive at viable solutions more quickly. In this context, long-standing expertise means not only technical know-how but also a deep understanding of how regulated organizations truly operate.

How development partners can help here:

• Early analysis of business and regulatory requirements.
• Development of customized solutions that integrate into existing system landscapes.
• Focus on security, quality, and sound technical concepts.
• Close coordination with customers to ensure that business needs and technology align.
• Sustainable implementation to ensure systems remain viable in the long term.

This results in software solutions that are not only suitable for the moment but also stand the test of time in a demanding environment.

Conclusion

Regulated industries don’t need fast software at any cost, but rather robust solutions. Identifying potential pitfalls early and choosing an experienced partner saves time, costs, and risks down the road.

This is precisely where long-standing expertise is a decisive advantage: It provides certainty, reduces friction, and thus becomes a true USP in the competition for the best solution.

“Great software is created where technical excellence, responsibility, and a deep understanding of customer needs come together. Our goal in engineering is to develop software that not only works but also creates real long-term value for our customers.”

For companies in Austria, this means that those who fail to act in a timely manner not only risk heavy fines but also lose the trust of customers, partners, and government agencies. The NISG applies to companies in 18 regulated sectors, including energy, transportation, healthcare, finance, water, digital infrastructure, and digital services. Critical infrastructure entities are subject to stricter requirements than other organizations.

Why IT Security Is Important Now

The threat landscape in cyberspace is constantly growing. Digitalization, connectivity, and cloud applications create new risks: Hacking attacks are easier to carry out today than ever before, and a simple PC with an internet connection is enough to gain access to company data. For companies, this means that without structured security measures, they face not only financial losses but also regulatory consequences.

The NISG not only requires affected organizations to implement security measures but also links these to a clear reporting obligation and a mandatory documentation requirement. Companies must demonstrate that they protect their IT systems, assess risks, and handle security incidents appropriately. ISO 27001 is recommended as a best practice to meet legal requirements while simultaneously strengthening the trust of customers and partners.

An Overview of the Key Requirements of the NISG

The NISG primarily sets out information security requirements for organizations, companies, and government agencies. Key areas include:

• Information security: Implementing appropriate technical and organizational measures to protect IT systems
• Risk management: Regular assessment and mitigation of cybersecurity risks
• Cooperation with suppliers and third parties: Ensuring IT security throughout the entire supply chain
• Information security breaches: Establishment of incident response processes and reporting requirements
• Continuous improvement: Regular review and optimization of security measures

ISO 27001 as the Foundation for NISG Compliance

Companies that already operate a high-level, ISO 27001-certified management system can achieve NISG compliance with relatively little effort. ISO 27001 certification already covers the organizational aspects of the NISG audit and allows companies to leverage synergies between the two standards. NISG and ISO 27001 can be efficiently audited in a combined audit.

ISO 27001 is internationally recognized and provides a solid foundation for cybersecurity in any organization. Organizations that have already implemented ISO 27001 meet a large portion of the NISG requirements and can focus on the specific reporting and documentation obligations.

Which organizations are affected?

The NISG applies to companies in 18 regulated sectors classified as critical infrastructure. These include:

• Energy: Electricity, gas, heating, and oil utilities
• Transportation: Aviation, rail, shipping, and road transport
• Healthcare: Hospitals, medical practices, pharmacies, and nursing homes
• Finance: Banks, insurance companies, and financial service providers
• Water: Drinking water supply and wastewater disposal
• Digital infrastructure: Internet service providers, cloud services, data centers
• Digital services: Online marketplaces, search engines, social networks

Affected companies must have at least 50 employees or generate annual revenue of 10 million euros to be considered subject to the regulation.

Conclusion and Recommendation

The NISG 2026 implements the EU NIS 2 Directive in Austria and significantly tightens IT security requirements. Affected companies must implement an information security management system (ISMS), report cyber incidents within 24 hours, and continuously document their security measures. Companies in the 18 regulated sectors should act early to meet compliance requirements in a timely manner and avoid heavy fines and a loss of trust.

“NISG 2026 is not merely a compliance issue, but a clear strategic mandate. Any organization that fails to implement IT security in a structured and verifiable manner today risks losing trust and competitiveness. Standards such as ISO 27001 provide the right foundation for this. It is crucial to act now.”

Recommendation:

• Check whether your company is affected by the NISG: Use compliance checks or consult with specialized advisors.
• Implement an ISMS in accordance with ISO 27001: This already fulfills a large portion of the NISG requirements and provides a solid foundation.
• Establish clear processes for incident response and reporting obligations: The 24-hour reporting requirement demands fast and well-coordinated procedures.
• Continuously document your security measures: Demonstrable compliance is essential.
• Seek support from specialized IT security partners as needed: External expertise accelerates implementation and helps avoid mistakes.

IT security is no longer an option today, but a key prerequisite for business success and legal compliance in the DACH region. Companies that act now are well-positioned—for NISG 2026 and for the future.

Modern IT Leadership: From Operator to Enabler

The role of the IT leader is undergoing a fundamental transformation: moving away from being purely a technical manager toward becoming a strategic enabler. This involves integrating technology and corporate culture with a focus on digital leadership skills and trust in teams. By 2026, when AI transformation and agile adaptation will be crucial, this will enable the realization of potential and innovation.

Three Key Levers for Digital Vitality

1. AI-Powered Software Development and Automation

Custom software solutions powered by AI boost efficiency in industry, government agencies, and medical technology. We optimize processes, accelerate business growth, and seamlessly integrate AI—for example, in research projects with our experienced teams. The result: faster time-to-market and measurable cost savings for your SME.

2. Compliance and Secure IT Operations

NIS-2, GDPR, and TISAX require resilient IT strategies. Our IT service management (analysis, data protection, process optimization) ensures our clients are future-proof. As a TOP Partner for SMEs 2026 and a Top 100 Innovator 2026, we ensure traceability and trust—which are essential for CEOs in regulated industries.

3. Sustainable IT Solutions (Green IT)

Sustainability is becoming a business case: Virtualization, resource-efficient hosting solutions, and Green IT reduce carbon footprints without compromising performance. IT executives leverage this to meet CSR goals and control costs. In this area, we act in a sustainable and forward-looking manner.

Adjustment lever	Challenge for CEOs and IT Directors	ASTRUM IT-Solution	Benefits
AI software	Skilled Labor Shortage, Complexity	Custom Development + Automation	Increased Efficiency
Compliance	Regulatory Risks	IT-Service-Management	Get Ready for Certification in Just a Few Months
Green IT	Pressure to be sustainable	Optimized Hosting/Cloud	Use of Renewable Energy

 

Praktische Handlungsimpulse für IT-Entscheider

Führen Sie einen Digitalen Vitalitäts-Check durch: Bewerten Sie Ihre IT-Reife in KI, Compliance und Nachhaltigkeit. Stellen Sie Dienstleistern diese Fragen: „Wie integrieren Sie KI ethisch? Welche Compliance-Expertise bringen Sie für NIS-2? Wie messen Sie Green-IT-Impact?“

Starten Sie mit einem unverbindlichen Strategiegespräch. Wir schließen Know-how-Lücken und boosten Ihre digitale Lebenskraft. Kontaktieren Sie uns für weiteren IT-Support.

Lutz, what do we at ASTRUM IT mean by “custom software development,” and what is the greatest value it offers our clients?

At ASTRUM IT, we define custom software development as solutions that are consistently tailored to our customers’ specific technical, organizational, and regulatory requirements. Our software is not a off-the-shelf product; rather, it is developed specifically for each use case, often as a proprietary solution in complex fields such as medical technology, industry, or public administration.

In my view, the greatest value we provide to our customers lies in efficiency, knowledge transfer, and flexibility. Close collaboration between our teams and the experts on the customer side also facilitates a sustainable transfer of knowledge. At the same time, custom software allows us to respond quickly and effectively to changing requirements or conditions.

What phases does a typical project go through—from the initial idea to the finished application?

It always begins with a clarification phase, during which goals, requirements, and framework conditions are defined collaboratively. This is followed by a conceptual phase, in which the architecture and technological foundations are established.

Implementation then proceeds iteratively and agilely, usually in short development cycles with regular feedback. This allows the software to be developed step by step while remaining adaptable at all times. The project typically does not end with a one-time go-live, but rather with supported commissioning and, if necessary, maintenance and further development.

In which industries are you currently particularly active, and what specific requirements do sectors such as healthcare or manufacturing entail?

Our current focus is on medical technology, the public sector, and manufacturing. In the medical technology sector, regulatory requirements, quality assurance, and traceability are key priorities. In the industrial sector, on the other hand, issues such as integration into existing IT landscapes, scalability, and long-term stability are crucial. The public sector, in turn, often demands a high degree of transparency, sustainability, and maintainability over long periods of time.

How does ASTRUM IT ensure that software solutions remain maintainable, secure, and expandable in the long term?

The foundation for this is a clean architecture with clear structures and modular concepts. This is complemented by automated testing, code reviews, pair programming, and the targeted use of AI in the respective development environment. We incorporate security from the very beginning—both technically and procedurally. Clear documentation and transparent decision-making ensure that software remains expandable over the long term.

Which trends or technologies are currently having the greatest influence on development work?

Cloud technologies, DevOps approaches, and artificial intelligence are usually the most influential factors. They enable scalable architectures, faster development cycles, and new functionalities. For us, however, it’s always crucial to use technologies only when they offer real added value for the specific use case.

What makes a software project successful for you personally?

For me, a project is successful when it’s compelling from a business perspective, technically sound, and accepted by users. Equally important is a collaborative, transparent partnership. If the project ultimately results in working software, acquired expertise, and a solid foundation for further collaboration, then it was a success.

Thank you very much for the interview, Lutz!

Custom software is created where standard solutions reach their limits.

Are you planning a new project or looking for an experienced development partner? Let’s work together to figure out how we can turn your vision into a working application!

What exactly does cloud repatriation mean?

Cloud repatriation refers to the deliberate decision to move workloads out of public cloud environments and back in-house or to a specialized hosting partner. Unlike a “panic exit,” this is not about reverting to the past but about a strategic realignment: Which applications truly benefit from hyperscalers, and which operate more cost-effectively, securely, and predictably in a stable, well-managed environment in Germany?

Typical triggers include:

• Unforeseeable or sharply rising cloud costs
• Complex compliance and data protection requirements (e.g., GDPR, NIS2, industry-specific regulations)
• Performance and latency issues involving legacy systems
• A strategic decision in favor of digital sovereignty and clear data control

It’s not a case of “cloud versus on-prem,” but rather finding the right mix. “In customer projects, we rarely see things in black and white. It’s not about cloud *or* data center, but about the *right mix* for the specific business case,” says Daniel Tantinger, Head of Technical Service at ASTRUM IT.

Typical scenarios: When repatriation makes sense

Cloud repatriation is not an end in itself but the result of an honest assessment. Typical real-world scenarios include:

The public cloud cost trap
Constantly growing data volumes, egress fees, and over-provisioning often mean that anticipated savings fail to materialize. Moving critical yet relatively static systems back to a managed data center can significantly stabilize monthly operating costs in such cases.

Strict compliance and audits
Companies in critical infrastructure (KRITIS), medical technology, and the financial sector face intense audit scrutiny. Storing and processing data in German data centers—backed by clear SLAs and German law—simplifies the audit process and the provision of necessary evidence.

Legacy Integration and Latency
Applications that interact closely with established on-premises systems quickly reach their limits in pure cloud architectures. A hybrid model—combining high-performance hosting in Germany with the selective use of cloud services—strikes a balance here.

How ASTRUM IT Supports Customers with Repatriation and Hybrid Scenarios

For many years, ASTRUM IT has been assisting companies in the industrial, medical technology, and public sectors with cloud migrations—and increasingly with the optimization and partial repatriation of their IT landscapes. The service portfolio comprises several steps:

1. Analysis & Strategy Workshop
A structured assessment captures existing systems, dependencies, security requirements, and cost models. The result is a clear target architecture: which workloads remain in the cloud, which are repatriated, and which are modernized?

2. Designing a Hybrid Target Architecture
Based on the analysis, ASTRUM IT develops an architecture that effectively combines public cloud, private cloud, and managed hosting. Key components include network design, security zones, identity and access management, as well as backup and recovery concepts.

3. Secure Migration & Repatriation
The actual relocation of workloads takes place in planned waves—incorporating test environments, fallback scenarios, and close coordination with business departments. This minimizes the risk of downtime and boosts acceptance within the organization.

4. Full-Managed Data Center Operations
Following repatriation, ASTRUM IT takes over operations using a full-managed service approach:
– Hosting of applications and databases in German data centers
– Provision of hardware (servers, storage, firewalls) and backend licenses (Windows, SQL, Veeam, etc.)
– Monitoring, backup & disaster recovery, and rights & configuration management
– Direct German-speaking telephone support and Level 2 support based on clearly defined SLAs

This allows internal IT teams to focus more on business-critical initiatives while the platform’s operations and security are professionally managed.

Practical Example: From “Lift-and-Shift” to a Sustainable Solution

Companies that migrated to the cloud using a quick “lift-and-shift” approach often discover that costs are difficult to forecast, latency affecting internal systems is high, and demands regarding compliance and auditability are rising.

We help organizations strategically evolve their IT architecture. Together, we assess the business criticality and usage patterns of their applications to develop a tailored solution. This often results in a hybrid architecture: dynamic services remain in the cloud, while business-critical systems are relocated to a managed hosting environment in Germany.

This enables companies to stabilize costs, boost performance, and reliably meet regulatory requirements. This approach demonstrates that repatriation is not a step backward, but rather a move toward a secure, cost-effective, and sustainable IT landscape.

Key Considerations for New Customers

Anyone considering cloud repatriation—or a general overhaul of their IT strategy—should ask the following questions:

• Are my current cloud costs transparent and sustainable in the long term?
• Do my existing solutions meet all compliance requirements, and can audits be passed easily?
• Where do I need genuine elasticity, and where do I prioritize stability and predictability?
• Do I have the resources to handle operations in-house, or would a fully managed service make more sense?

ASTRUM IT draws on extensive experience to help answer precisely these questions, combining software engineering, hosting expertise, and industry know-how.

If you have any questions, simply get in touch with our team of experts!

Patrick, what motivated you to write a book on IT security for small and medium-sized businesses right now?

Patrick: In my day-to-day work at ASTRUM IT, I see that many small and medium-sized businesses still believe they are “too small” to be targeted by attackers. The opposite is true: SMEs in particular often lack clear structures and emergency plans. With this book, I want to show that cybersecurity is an existential management issue. It’s about understanding where liability risks lurk and how to build true digital resilience through pragmatic steps. That’s exactly what we implement every day in projects at ASTRUM IT.

You say: “IT security isn’t a project, but a mindset.” What does that mean in the day-to-day operations of a company?

Patrick: Sustainable IT security only works if it’s conceived as an ongoing process: clear responsibilities, recurring audits, and emergency plans that are tested time and again. This means that risk analyses or backup tests are firmly integrated into the annual cycle. At ASTRUM IT, we support this with structured IT security audits and cybersecurity consulting, while always keeping a close eye on the current threat landscape and regulatory developments.

How do you specifically view ASTRUM IT’s role for small and medium-sized businesses?

Patrick: ASTRUM IT supports companies from analysis through to operational implementation: We identify which systems are business-critical and where vulnerabilities lie. This ranges from managed services to disaster recovery plans. We explicitly do not see ourselves as NIS 2 consultants and do not actively offer this type of consulting. Our focus is on operational IT. However, as a responsible partner, it is our duty to protect our clients: If we notice vulnerabilities in day-to-day operations that are relevant to NIS 2, for example, we proactively point out this potential for improvement. If questions arise, we then support our clients on a case-by-case basis and to the best of our ability.

In your experience, in which areas do small and medium-sized businesses most often underestimate the risks?

Patrick: A major issue is preparing for emergencies. Many companies have backups, but rarely test how quickly they can actually get back up and running. Another risk is a lack of security awareness. At ASTRUM IT, we lead by example and rely on intensive awareness initiatives as well as technical safeguards for our own employees to ensure that our team remains part of a robust security chain. We incorporate this internal experience into our general consulting for clients to raise awareness of human risk factors there as well.

What are the three measures that business owners should tackle first today?

Patrick: First, an honest assessment of business-critical systems is needed. Building on that, tested backup strategies and clear responsibilities should be established. As a third step, I recommend an external perspective, such as through an IT security audit. Here, operational requirements—as also stipulated by the NIS 2 Directive—are naturally incorporated into our work, as we always take a holistic view of security.

What is your key message to small and medium-sized businesses?

Patrick: Today, IT security is key to a company’s long-term viability. It must be understood as an integral part of the corporate culture and treated by management as a leadership priority. Investing in IT security today strengthens a company’s ability to innovate and compete.

Thank you very much, Patrick, for the interview!

It’s time to act fast! Make your company resilient against digital threats. For more information about our services, please visit our Webseite.

About the Author

Author: Patrick Fabisz
Title: “Digital Total Collapse – Why IT Security Is Not an IT Project, but a Survival Strategy for Small and Medium-Sized Businesses”
Publication Date: April 1, 2026
Available on Amazon