Skip to content
Book a consultation
МКEN
Illustration: an owl made of glowing points, a symbol of vigilanceIllustration: Earth drawn in glowing green country borders, with North Macedonia highlighted

SOC 24/7 · Testing · Compliance

Cybersecurity that never blinks.

From Skopje, we watch your systems around the clock, test them the way an attacker would, and prepare you for the NIS2-aligned law, ISO 27001 and DORA. Machines handle the routine; a person makes every call that could disrupt your business.

Book a consultationHow our SOC works
  • SOC 24/7
  • Team in Skopje
  • Information security since 2007
  • FINKI partner
  • Every action approved by a person

From Skopje

Protecting your organization, wherever it operates.

Our SOC is in Skopje. Your systems can be anywhere: an office, a data center or the cloud, in North Macedonia or abroad. Their signals reach one place, where analysts watch them day and night.

Services

Detection, testing and compliance from one team

Our services sit in three pillars. You can start with any one of them, and they reinforce each other: test findings sharpen detection, and SOC case records supply the evidence auditors ask for.

See all services
Detection & ResponseManaged SOC 24/7Round-the-clock monitoring, detection and response across EMEA, with AI-assisted triage and analysts who make the final call.Learn moreDetection & ResponseIncident response & forensicsPlans, playbooks and exercises before an incident; containment, forensics and reporting support when one happens.Learn moreOffensive SecurityPenetration testing & red teamingManual testing of networks, applications, cloud and people, with CVSS-rated findings, clear reports and a retest of fixes.Learn moreOffensive SecurityAI securitySecurity testing for LLM applications and AI agents, AI red teaming, and clear rules for adopting AI safely.Learn moreGovernance & PeopleNIS2 complianceScoping, gap assessment and readiness for North Macedonia’s NIS2-aligned law, from portal registration to incident reporting.Learn moreGovernance & PeopleISO 27001 implementationAn ISO/IEC 27001:2022 management system built around your risks, from scoping and controls to the certification audit.Learn moreGovernance & PeopleDORA complianceDORA readiness for local subsidiaries of EU financial groups and for ICT providers that serve EU financial entities.Learn moreGovernance & PeopleSecurity awareness & phishing simulationRole-based training and ethical phishing simulations that build a reporting culture, in Macedonian and English.Learn more

How our SOC works

AI speeds up triage. A person makes the call.

Automation and AI take on the repetitive work, so analysts have time for what actually matters. Nothing that could disrupt your operations runs without human approval.

  • 01

    Correlated detection

    Telemetry from endpoints, servers, cloud, network and identity is correlated into detections mapped to MITRE ATT&CK. An alert is promoted when signals connect, not because a single event looks severe.

  • 02

    Automatic enrichment

    Before an analyst opens the case, the alert already carries threat intelligence, reputation data, network intrusion signals and related prior cases.

  • 03

    AI drafts the first analysis

    AI summarizes the facts: what happened, which systems are involved and what is likely to come next. The analyst checks that draft and confirms or dismisses the alert.

  • 04

    A person approves, everything is logged

    Blocking an address, isolating a device or disabling an account needs an analyst’s approval. Each action is logged with who approved it and when, and comes with a rollback.

  1. 01TelemetryLogs and signals from endpoints, servers, cloud, network and identity.
  2. 02DetectionCorrelated rules mapped to MITRE ATT&CK.
  3. 03EnrichmentThreat intelligence, reputation and prior cases.
  4. 04AI triageAI drafts the first analysis and hypothesis.
  5. 05AnalystA person confirms and approves every action.
  6. 06ResponseContainment that is logged and reversible.

Machines enrich. People decide.

How our SOC handles an alert
How our SOC works

NIS2-aligned law

New obligations apply from 1 January 2026

North Macedonia’s new cybersecurity law is aligned with the NIS2 Directive. It covers essential and important entities: public sector institutions, and medium and large entities in sectors such as energy, transport, banking, health and digital infrastructure.

Read the NIS2 guide
deadline for the first notice of a significant incident to the competent CSIRT
3 hours
deadline for the first notice of a significant incident to the competent CSIRT
deadlines for the early warning and the incident notification
24 / 72 hours
deadlines for the early warning and the incident notification
for risk management, mandatory for every entity in scope
10 measures
for risk management, mandatory for every entity in scope
the date the law began to apply
01.01.2026
the date the law began to apply

Industries

Shaped around your sector’s obligations

A bank, a ministry, a mid-size company and an international group each answer to different rules, risks and decision-makers. We fit the scope to yours and keep the approach the same.

01Banks and financial institutionsBanking and the financial market are among the sectors where North Macedonia’s NIS2-aligned law already applies to medium and large entities. If you are a subsidiary of an EU banking or insurance group, your group will also expect DORA compliance, even though the regulation does not apply directly in North Macedonia.Learn more02Public sector and critical infrastructureUnder the law, the Assembly, independent state bodies and regulators, the Government, ministries, state administration bodies, courts, municipalities and the City of Skopje are essential entities. So are owners and operators of critical infrastructure, regardless of size. The law is not mandatory for the Ministry of Interior, the National Security Agency, the Operational-Technical Agency, the Directorate for Security of Classified Information, the Intelligence Agency, the Ministry of Defence and the Public Prosecutor’s Office, and it does not apply to the National Bank.Learn more03Mid-size companiesIf you are a medium or large company in energy, transport, banking, financial market, health, digital infrastructure or B2B ICT service management, the law already applies to you: medium entities are important, large ones are essential. Size follows the classification in North Macedonia’s Company Law, not the EU definition of small and medium-sized enterprises.Learn more04International companies in North MacedoniaIf your group is based in the EU or further afield and part of your business runs in North Macedonia, you need a local partner who knows the Macedonian rules and reports in English, in the format your group already uses.Learn more

Approach

How we work

Four rules that hold for every engagement, from a first test to 24/7 monitoring.

  1. 01

    People decide

    AI and automation make the work faster; they do not make decisions. Every action that touches your systems is approved by an analyst.

  2. 02

    Scope agreed up front

    Before we start, we agree in writing on scope, rules of engagement, timing and escalation contacts. No surprises on either side.

  3. 03

    Evidence for every finding

    Each finding, case and recommendation comes with evidence you can check yourself and show to your board or your auditor.

  4. 04

    Your data stays yours

    Each client has an isolated environment. Only confirmed indicators with no client details, such as a malicious IP address, are shared across clients.

Team

A team in Skopje you can actually meet

We have worked in information security since 2007. Meet the people who lead the company, its technical strategy and our SOC.

Meet the team

  • Vlatko Cvetanoski

    Chief Executive Officer (CEO)

  • Dimitar Blazevski

    Chief Technology Officer (CTO)

  • Stefan Trajkovski

    Head of Security Operations

Frequently asked questions

FAQ
What kinds of organizations do you work with?
We build our services for four groups: banks and financial institutions, the public sector and critical infrastructure, mid-size companies, and international firms operating in North Macedonia. Scope, reporting rhythm and report language are tailored to each.
Do we need a SOC if we already have antivirus and a firewall?
Those tools stop many known threats, but they do not see what happens between systems. A SOC correlates signals from endpoints, servers, cloud, network and identity, so it catches attacks that look harmless one event at a time, such as a sign-in with a stolen password, and responds while the attack is still in progress.
Can we start with just one service?
Yes. You can begin with a penetration test, a readiness review against the NIS2-aligned law, or 24/7 monitoring. Each service has a clear scope and deliverable, and it connects easily to the others later.
Why choose a local cybersecurity partner?
We work in your time zone, we know North Macedonia’s regulations and procedures, and our office is in Skopje, so we can be on site when it matters. If you are part of an international group, we also report in English, in a format your group can use.
What do we get at the end of an engagement?
A written report for two audiences: a summary for management and detailed findings for the technical team, with evidence, a risk rating and prioritized recommendations. With monitoring you also receive monthly reports on incidents, trends and suggested improvements.

Let’s talk about your security

Tell us what you need: 24/7 monitoring, testing or readiness for the NIS2-aligned law. In a short call we will agree on scope and next steps.

Book a consultation+389 75 340 034

Mon–Fri 09:00–17:00 · SOC 24/7 · info@diverto.mk