Security services

Understand how attackers can break in – and how to stop them. We test:

• Web & API (OWASP): authentication, session management, logic flaws.
• Mobile apps: storage, transport protection, jailbreak/root protection.
• Infrastructure & AD/Entra ID: segmentation, privilege escalation, Kerberoasting.
• Cloud (M365/Azure, AWS, GCP): IAM, misconfigurations, data exposure.
• Wi-Fi/Net: rogue AP, certificates, encryption.
• Red Team/Assumed Breach and Social engineering (phishing/vishing) if needed.

Deliverables: CVSS risk-rated findings, reproduction steps, business impact, prioritized action list, and retest.

Quick overview and a prioritized plan.

• Risk & vulnerability analysis (RVA) and maturity analysis (CIS, NIST CSF, ISO 27001).
• Attack surface and asset review: internal/external systems, shadow IT, exposed services.
• Hardening and configuration review: AD/Entra ID, clients, firewall, EDR/XDR.
• Cloud Security Review: identities, permissions, logging, backup/restore.
• Third-party audit: suppliers, contracts, continuity.

Deliverables: executive summary, detailed recommendations, and a time-bound action plan.

• Incident Readiness & Tabletop Exercises: playbooks and training sessions.
• Incident Response Retainer: pre-agreed emergency support when minutes matter.
• Security Architecture/Zero Trust: practical segmentation and least privilege.
• IAM: MFA, conditional access, PIM, lifecycle (joiner-mover-leaver).
• Vulnerability Management: scanning, prioritization, patching, KPIs.
• Lightweight Security Monitoring: alert chains, basic detection and actions.
• Training & Awareness: targeted, measurable training.

From gap analysis to ongoing compliance, including system support.

• Gap analysis & roadmap for NIS2 and/or ISO/IEC 27001 (optionally 27701 for privacy).
• ISMS implementation: policies, processes, roles, KPI/OKR.
• Risk & control frameworks: risk registers, control libraries, internal controls.
• Supervision & reporting: incident reports, supplier requirements, BCP/DRP.
• Data protection (GDPR) & DPIA: data classification, access control, traceability.
• Audit & certification support: internal audit, management reviews, action follow-up.

We offer and implement platforms that simplify everyday work:

• Policy & document management with approval workflows and version tracking.
• Risk registers & action plans with ownership, deadlines and reminders.
• Control libraries & mappings across NIS2, ISO 27001/27701, CIS, and NIST.
• Evidence collection & auditing: tasks, proof, deviations, audit records.
• Compliance dashboards for real-time management and oversight.
• Case & incident flows: from detection to action and reporting.

Result: clear traceability, less manual work and faster compliance.