Cyber Security Services for SMEs and Online Businesses

After the check you know which of your systems and credentials are exposed on the internet and what to do first.

For whom: every company with a website, online shop, customer portal or Microsoft 365. Typical triggers: a security questionnaire, an upcoming relaunch, a wave of phishing e-mails or simply the question of what attackers can find about you online.

Included:

• your written authorisation before we start
• an inventory of your publicly visible domains, subdomains, servers, cloud and Microsoft 365 services
• automated checks for known vulnerabilities, assessed by certified specialists; hosted platforms and cloud services such as Shopify or Microsoft 365 only within the provider's rules
• a search for credentials of your company domain in known data breaches
• for existing clients also: our team reviews the admin accounts, apps and plugins of your website or shop
• findings ranked by urgency, a results call and a clear recommendation for the next step

Turnaround: typically about one week from authorisation.

Fixed price after an initial analysis

Request an outside-in check

Website penetration testing that shows which weaknesses your applications have, how serious they are and in what order to close them.

For whom: online shops, web apps, customer and member portals, APIs, AI chatbots and agents. Triggers: a go-live, relaunch or major release; a new login, payment or customer-data feature; an AI agent that will answer without human approval; a customer, marketplace or insurer asking for a test report.

Included:

• scoping, kick-off and written authorisation
• web application penetration testing along the OWASP Top 10 and the OWASP Web Security Testing Guide: login and roles, cart and payment, customer data, admin areas
• API penetration testing of your own interfaces to ERP, CRM, apps and partners
• AI chatbots and LLM features: prompt injection, jailbreaks, unintended data disclosure
• on Shopify and other hosted platforms: your own code (theme customisations, custom apps, your own interfaces, headless frontend), preferably in a development store or preview environment and within the platform provider's terms; for third-party apps we review configuration and permissions, not the vendor's servers
• every finding confirmed by hand, a prioritised report and a closing meeting
• optional: fixes by our team and a re-test

Typical effort: usually 2 to 10 person-days, depending on the size of the application; a re-test is usually much shorter.

Fixed price after an initial analysis

You learn which routes an attacker could take into your network and cloud, and get the countermeasure for each one.

For whom: companies with their own servers, a Windows domain or Microsoft 365 and Azure. Triggers: NIS2 risk management, ransomware concerns, a new IT provider, a cyber insurance questionnaire or the yearly test cycle.

Included:

• scoping, kick-off and written authorisation; for red teaming and social engineering also agreed rules of engagement and an emergency contact
• external penetration testing: your internet-facing servers, VPN and e-mail access; scanners give leads, specialists verify and follow up every hit
• internal penetration testing with Active Directory: starting from a machine on your network that is assumed to be taken over, the specialists look for routes to domain admin rights
• Microsoft 365 security assessment and Azure: who can do what, how accounts and sign-ins are protected, how the cloud connects to the internal network
• reviews of Active Directory, Microsoft 365 and network or OT architecture against IEC 62443, as a configuration review
• red teaming with social engineering on request, for larger organisations
• infrastructure findings are fixed by your IT team or IT provider; you receive the prioritised list

Typical effort: single tests usually 2 to 10 person-days, depending on the number of systems; red teaming several weeks.

Fixed price after an initial analysis

You know whether and how NIS2 affects you, and you have a plan with clear priorities.

For whom: medium-sized and large companies in NIS2 sectors in the EU, and suppliers inside or outside the EU whose in-scope customers pass NIS2 requirements down the supply chain.

Included:

• NIS2 applicability: whether you are covered directly as an essential or important entity, or indirectly as a supplier
• support with registration where it applies to you
• a NIS2 gap analysis of your security measures against the requirements, with a prioritised plan
• a process for reporting significant incidents: who decides, who reports, by when
• cyber security training for management
• supplier version: when customers pass NIS2 requirements on to you, we prepare questionnaires and evidence with you

Typical effort: usually 2 to 10 person-days, depending on size and starting point.

Fixed price after an initial analysis

Not legal advice; you complete any registration yourself.

You see where you stand against a standard and reach the audit with a clear plan.

For whom: companies whose tenders, key accounts or industry rules ask for evidence against ISO 27001, TISAX, IEC 62443 or DORA, and companies that want a solid baseline without certification (CIS Controls).

Included:

• ISO 27001 gap analysis or a cyber security gap analysis against NIS2, TISAX, IEC 62443, DORA or CIS Controls: we talk to the people responsible, review policies and evidence and rate every requirement on a maturity scale. The result is an action plan that starts with what matters most
• ISMS set-up: together we define the scope, set the risk assessment method and draft the Statement of Applicability (SoA), plus responsibilities and a timeline towards the audit
• ISO 27001 implementation support up to the stage 2 certification audit, including an internal audit
• The certificate is issued by an accredited certification body of your choice; its audit fees are not included.

Typical effort: gap analysis usually 2 to 10 person-days per standard; the path to the certification audit usually takes several months.

Fixed price after an initial analysis

Information security has a named owner in your company who reports to management.

For whom: companies without a security lead; NIS2 entities whose management must oversee the risk-management measures; companies facing a growing pile of customer security questionnaires.

Included:

• vCISO as a service: a named person in the CISO role, reporting directly to management
• regular meetings with your team on risks, open actions and policies
• preparing the management review
• answering security questionnaires from your customers and suppliers
• coordinating tests, monitoring and fixes, with our team for web, shop and app

Typical effort: a few person-days per month.

Fixed price after an initial analysis (monthly)

New vulnerabilities and leaked credentials surface between two tests, not only at the next one.

For whom: companies after an outside-in check or a pentest, teams that release often, NIS2 entities, and clients of our website maintenance who want to add security monitoring.

Included:

• attack surface and dark web monitoring after your written authorisation: your internet-facing systems are discovered and checked for new vulnerabilities on an ongoing basis; if credentials of your domain appear in data breaches or on the dark web, you are told
• optional scanners inside your network, with all findings in one view
• pentest as a service: you reserve person-days for the year and use them whenever your systems change significantly or findings need a re-test; each call-off starts with its own written authorisation, and the same people who already know your environment do the testing
• optional DNS protection with an allowlist: devices on your network only connect to domains rated as trustworthy
• we set everything up, train your team and stay on it; findings in your website, shop and app go straight to our team

Typical effort: pentest as a service with as many person-days a year as you need; monitoring and DNS protection licensed by company size.

Fixed price after an initial analysis, licence by company size

Your staff learn to recognise phishing before anyone clicks.

For whom: every team that handles e-mail, orders and payments; NIS2 entities that must train their staff and management; after a phishing incident or at your insurer's request.

Included:

• simulated phishing e-mails after written authorisation by management, evaluated by team rather than by person and agreed with your works council where there is one
• role-based training for staff, managers and IT
• a short report with next steps, repeatable every year

Typical effort: depends on team size and format.

Fixed price after an initial analysis