Know-how and development
Drawings, recipes, manufacturing processes and source codes — remain trade secrets only if you demonstrably protect them.
Information protection
Protection against industrial and commercial espionage
Trade secret protection regime — from information classification to operational security (OPSEC) of key persons — which will also serve as a document in the event of a legal dispute.
classification of informationclosed escape routessituational OPSEC rules
He is responsible for this service
Head of the operational department
GBH Group Operational Command
An escape rarely looks like an attack
Discreet exploitation at a trade fair, fake demand or fictitious interview, targeted recruitment of your people by competitors, infiltration through temp workers and service companies, eavesdropping on sensitive actions — the repertoire of industrial espionage is wider than "hacking". And most leaks don't even need that: offers in unencrypted attachments, a vendor with role-exempt access, and a departing employee who takes documentation and contacts with them.
- The majority of leaks originate from within — an insider threat, not a targeted attack from the outside.
- Social engineering targets people: extortion at fairs, fake inquiries and interviews.
- Contractors, service and cleaning tend to have a broader approach than their role requires.
- Without demonstrable measures, it will be difficult to invoke the protection of trade secrets in court.
Scope
What the product is — and what it isn't.
Includes
- Classification of information — degrees of sensitivity and handling rules
- Insider threat throughout the employee's life cycle
- Approaches of suppliers and outsourcers according to the principle need-to-know (only those who have to know)
- Situational OPSEC: negotiations, trips, fairs, preparation of acquisitions
- Plan of first steps in case of suspected leakage
Does not include
- We do not track employees or third parties
- We do not eavesdrop or collect third-party data
- We do not replace your IT or legal department
- We do not guarantee zero risk — we will describe the rest
Procedure
First the reality. Then measures.
-
01
Asset analysis
Asset Map and Classification
We map out where your critical information originates and resides, who has access to them, and assign them degrees of sensitivity.
-
02
Escape routes
The attacker's repertoire
We will oppose real processes with the attacker's techniques: social engineering, fake requests, infiltration through suppliers, eavesdropping on negotiations and people leaving.
-
03
Draft measure
Prevention, detection, response
Measures in three branches — prevention, detection, response — always proportional to the value of the asset: approaches, handling rules, plan for suspected leakage.
-
04
Mode and Verification
Implementation and verification in practice
We will train people, set up an exit protocol, and verify the regime's functionality in practice — with your consent, for example, through a social engineering review.
Coverage
The measures must be proportionate to the value of the asset. We only protect what is truly sensitive.
Contracts and terms of business
Pricing, calculations and offers — data that the competitor will use in the next tender.
Management and proceedings of the board of directors
Board documents and preparation of acquisitions — including meeting room mode and telephones for sensitive negotiations.
Suppliers and outsourcers
Scope of needs-to-know access, confidentiality and third-party vetting in the supply chain.
Key people
Digital footprint, appearances at trade fairs and conferences, security mode when traveling abroad.
Arrivals and departures
Employee life cycle: screening during recruitment, role changes, risk signals and exit protocol when leaving.
Output for management
OPSEC schedule
Structured document for management + briefing of key persons.
What the document contains
- Classification of information s loading rules for each level
- Typology of attack techniques and escape routes with priorities
- Measures in branches prevention — detection — response
- Situational OPSEC: negotiations, trips, fairs, acquisitions
- Exit protocol and plan of first steps in case of suspected leakage
A document based on which decisions and actions are taken — and at the same time proof that you actively protect trade secrets. Without demonstrable measures, it is difficult to invoke its protection.
Role and mode
Who decides and how we cooperate.
- 01
Senior Consultant (single point of contact)
One person you deal with from start to finish and who is accountable.
- 02
Security analyst
It classifies information, models escape routes and prepares measures and documents for decisions.
- 03
Guarantor on the client's side
A decision-making person designated by you, with whom we agree the scope and priorities.
Operational log
- We will agree on the status and priorities at the initial meeting within two weeks.
- We report progress and findings at agreed upon milestones, not all at once.
- OPSEC mode we usually revise once every 6-12 months.
- In case of a major change (acquisition, new supplier, departure of a key person), we start the review earlier.
- One time or continuously
- We start with a one-time assessment and plan; upon request, we continue with an ongoing review in the form of a flat rate.
- Time frame
- Assessment and plan usually within 4-8 weeks depending on business size and scope.
- Engaging your team
- We work with your IT, legal and HR — we don't replace them, we complement and connect them.
- Scope by scenarios
- We build the range on specific leak scenarios, not a flat rate — you pay for what makes sense.
Discretion
We are working inconspicuously, to the extent necessary for work and only with people who really need to know. We keep the findings and documents secure and share them only with your guarantor. Confidentiality has its legal limits — we will tell you in advance what the law requires us to disclose.
- Nondisclosure Agreement (NDA) as standard
- The need-to-know principle — only those who have to know
- Secure storage of documents and findings
- An unobtrusive procedure without disrupting traffic
Standards and the law
Trusted capacity, within the limits of the law.
- A team with proven experience in information security and corporate protection
- Methodologically, we are based on ISO/IEC 27001/27002 principles (classification, access control)
- Wiretapping Detection — Defense Technical Search (OTP/TSCM) on your premises only
- Screening of persons exclusively from open sources (OSINT) and in accordance with GDPR
- Mode verification in practice only with your consent
We work within the law. We don't do what's over the edge. We only protect your own information and spaces — we don't track third parties, we don't eavesdrop, and we don't get third-party data. We only do reviews from legal and public sources and in accordance with GDPR. We do not have and do not offer any offensive or stealth capabilities against anyone.
Proof system
Specifically, but discreetly.
A service detail should not end with a promise. It shows an anonymized scenario, methodology and output that management will really use.
We do not show the client. We show the decision.
- 01 A find. Which is really weak.
- 02 Procedure. Who decides and when.
- 03 Output. OPSEC schedule
Deliverable preview
OPSEC schedule
- Classification of information s loading rules for each level
- Typology of attack techniques and escape routes with priorities
- Measures in branches prevention — detection — response
Guides and analysis
Part of the GBH group
GBH Partners
Protection of information during travel, negotiations and expansion into risky countries.
GBH Capital
Investment division of the security infrastructure financing group.
GBH Cyber
Technical protection of data, identities and access against information leakage.
GBH Bunker
Physical protection of spaces where sensitive information is created and stored.
GBH Academy
Training people who are the easiest way in for an attacker.
Related services
All services
Protection against eavesdropping
Protection against eavesdropping (TSCM)
defense technical inspection
finding report with spectrum recording
mode of action
Digital resilience
Cyber and data resilience
digital footprint map
incident response (IR) plan
priorities for management
Investment risk
Due diligence and screening
counterparty and beneficial owner due diligence
risk memo with the severity of the findings
recommendation: sign, negotiate, withdraw
Questions for decision
Is it legal? Aren't you following people?
We exclusively protect your own information, documents and premises. We do not monitor employees or third parties, we do not eavesdrop and we do not obtain third-party data. We do any checks only from legal and public sources and in accordance with GDPR.
Will anyone find out that we are working with you?
Not if you don't want it yourself. We work discreetly, according to the need-to-know principle and with a non-disclosure agreement. We only share the findings with your guarantor. There are legal limits to confidentiality — we'll tell you in advance what we need to disclose.
Will it disrupt normal business operations?
We strive for the opposite. We will carry out most of the work without interfering with traffic, and we propose measures to make people's work easier rather than more complicated. We will tell you in advance what would delay traffic and agree on the pace.
What if you find something during the assessment?
We will switch to a reactive procedure: do not delete or forward anything, first preserve the evidence. We will document the findings so that they will stand up in any court proceedings and advise when to involve lawyers and when to involve the police. We don't scare and we don't make a case out of it.
Do you guarantee that there will be no more leaks?
Nope. Nobody honest can promise zero risk. But we can significantly reduce it, describe the residual risk and give you control over what is really sensitive. Then you make a decision with clear information.
How do we know what to include?
We build the range on leakage scenarios that really concern you — the mode of a company with its own development looks different, the company before the acquisition looks different. We keep the measure proportional to the value of the asset; we'll only recommend what makes sense and tell you what you don't need.
Let's casually discuss what is really sensitive about you
"The first interview is discreet and non-binding. We will say if and how our work makes sense — without pressure and without intimidation."
Tomáš Šlesinger · GBH Group Security Advisor
Contact us
Discuss your crisis preparedness with us
Initial consultation
Tell us what you need help with.
Briefly describe your situation and leave your contact details. We will arrange a suitable time to talk.
Call