Eleven audits you can contract separately or combined. They all end in a report with findings ranked by risk and the specific measure to fix each one.
If you don't know what you need, start with the initial assessment: a general review that tells you which audits make sense for you and in what order.
If you already know what worries you, pick the areas directly. We group them into four blocks.
To get an overview and know what an attacker sees from outside.
A compact 360° view: inventory, external exposure, identities and MFA, patching, backups, endpoint protection, training and basic physical security.
Subdomains, published ports and services, expired certificates, exposed admin panels, open cloud storage and corporate credentials in public leaks.
Authenticated and unauthenticated scanning of all devices, with manual removal of false positives and confirmation of critical findings.
What's inside the office: network, servers, accounts and Wi-Fi.
Segmentation and VLANs, firewall rules, published services, default credentials, unsupported firmware, guest and IoT/OT networks, and network access control.
Review against CIS Benchmarks: patching, unnecessary services, file share permissions, encryption, logging, service accounts, virtualisation and databases.
Privilege escalation paths, privileged accounts, insecure delegations, misconfigured GPOs, stale accounts and the real password policy versus the stated one.
Encryption and key strength, real isolation of the guest network, rogue access points, WPA Enterprise and signal reach outside the building.
Email, files in the cloud and applications published on the internet.
Identities and permissions, MFA on admin accounts, conditional access, mail forwarding rules, consented apps, external sharing and audit logging.
OWASP-guided review: authentication, sessions, authorisation, injections, file uploads, headers and business logic in critical flows.
Getting back to work after an incident and protecting the server room.
That backups exist, cover what they should, are protected against deletion and encryption and actually restore, with a real restore test.
Access control to restricted areas and the server room, visitor management, cooling, UPS, fire protection, GDPR-compliant CCTV and exposed network ports.
Before starting we sign the scope, the NDA and the testing authorisation. For critical and high findings we carry out exploitability validation: we prove in practice that the risk is real, with no denial of service or data modification, stopping as soon as we have the proof. It is planned to minimise impact, with a specific authorisation, an agreed time window and an immediate stop procedure.
We follow recognised references so the result is comparable and useful to third parties:
For companies with more than 250 users we offer focused, in-depth work: single-topic audits (Active Directory only, cloud only, backups only), multi-site physical security audits with the same methodology, an independent second opinion on your current provider's work, or specialist hours to support your team.
It depends on your environment and your risks. Backups are often a priority, because they are what lets you get back to work after an incident, but they don't replace the other measures. If you are unsure where to start, the initial assessment is designed to decide exactly that.
We plan it to minimise impact. Most of the work is configuration review. Tests that could have an effect are carried out with authorisation, in windows agreed with you, with no denial of service or data modification and with an immediate stop procedure.
We don't sell penetration testing as a product. We carry out technical audits with exploitability validation on critical findings, which in a small business usually find more, with a clear scope.
NIS2 sets cybersecurity requirements for entities in certain sectors, mainly medium and large ones, although it can also reach some smaller ones. We review your situation from a technical standpoint and the measures that can be applied.
This technical review does not replace legal advice.
