Security

The Security department packages our cybersecurity competences into three offerings - from a quick digital-hygiene review to permanent oversight of your infrastructure. Each starts with a jointly defined scope and ends with a report and help in implementing the recommendations.

We work with web applications, network infrastructure, cloud environments, Active Directory and Microsoft 365, embedded/IoT systems and AI/LLM components. Security is not a single report - it is a series of planned, systematic actions.

Web application penetration testing (OWASP Top 10, business logic)
Network, server and edge infrastructure testing
Active Directory, Entra ID and Microsoft 365 audits
AI/LLM system security testing and AI consulting
OSINT reconnaissance: subdomains, public buckets, data leaks
Workstation security analysis and social-engineering resilience

Packages

Three Security packages

Packages build on each other: CYBER PLUS includes the full CYBER scope and CYBER PRO the full CYBER PLUS scope. Pricing depends on the size of the environment - we prepare it after a short conversation.

01

CYBER

Security foundation

Turnaround: 2-3 business days
Price: Individual quote

For whom

Companies with WordPress websites or landing pages that want to know whether they are protected against the most common attacks.

Scope

Web securitySSL certificate and HTTPS configuration, HSTS, CSP, X-Frame-Options and X-Content-Type-Options headers.
Mail and DNSSPF, DKIM and DMARC records, spoofing protection, security.txt check.
WordPress / landing pageWordPress and plugin versions, default passwords and admin account, hidden files (e.g. wp-config.php backups), wp-admin, wp-login and XML-RPC.
Cookies and sessionsSecure, HttpOnly and SameSite flags and session lifetime.
Basic application testsForms (spam, injection), password reset, search (XSS) and file upload.

DevOps support

You receive a security report with prioritised actions. Our DevOps team walks you through it and helps you roll out the fixes quickly - you are not left alone with a list of problems.

Ask about this package

02

CYBER PLUS

Deep resilience

Turnaround: 5-7 business days
Price: Individual quote

For whom

Software houses, e-commerce and companies with their own customer panels and VM/Docker infrastructure that need to know whether their applications and infrastructure are really secure.

Scope

Full CYBER scopeAll tests from the CYBER package.
Application testing (OWASP Top 10)Manual business-logic testing, SQL/NoSQL Injection, all types of XSS, CSRF, IDOR, Authentication Bypass and Session Fixation.
Server infrastructurePort scanning, service and version identification, known CVE vulnerabilities and misconfigurations (e.g. Nginx, Redis, databases, Docker).
Office and edge infrastructureExternally exposed services (VPN, admin panels), network topology (CIDR) and hidden assets.
OSINT reconnaissanceSubdomains, Shodan and Censys, public S3/Azure Blob buckets, basic Dark Web monitoring.
AI consultingAnalysis of the use and security of AI solutions within the organisation.

Security and DevOps support

We work directly with your IT team: configuration consulting, joint roll-out of fixes and full follow-up with re-tests included. The report does not end up in a drawer.

Ask about this package

03

CYBER PRO

High protection

Turnaround: 10 days per month
Model: Subscription, 12-month monitoring
Price: Individual quote

For whom

Companies for which security is a very high priority. It is like having your own security team constantly watching over your infrastructure.

Scope

Full CYBER PLUS scopeAll tests from the CYBER PLUS package.
ContinuityMonthly vulnerability scanning and quarterly penetration tests of new features.
Vulnerability managementVulnerability management platform and analysis of potential threats.
Identity and cloudMicrosoft 365 and Entra ID audit and consulting: MFA policies and user permissions.
Internal infrastructureLAN segmentation and lateral movement testing.
Extended reportRecommendations, consulting and configuration hardening in line with best practice.

Security, DevOps and Networks

Our engineers proactively roll out fixes, update configurations and systems and teach your team good practice. You have access to our experts at any time.

Ask about this package

Comparison

What each package covers

The detailed scope of tests in the CYBER, CYBER PLUS and CYBER PRO packages.

Scope	CYBER	CYBER PLUS	CYBER PRO
SSL and HTTPS
SSL certificate and HTTPS configuration check	✓	✓	✓
HTTP headers
X-Frame-Options, Content-Security-Policy, X-Content-Type-Options, HSTS	✓	✓	✓
DNS and mail
SPF, DKIM, DMARC records and spoofing protection	✓	✓	✓
.well-known check (security.txt)	✓	✓	✓
WordPress / landing page
WordPress and plugin versions, default passwords and admin account	✓	✓	✓
Hidden files (wp-config.php backups), wp-admin, wp-login, XML-RPC	✓	✓	✓
Cookies and sessions
Secure, HttpOnly, SameSite flags and session lifetime	✓	✓	✓
Basic application tests
Forms (spam, injection), password reset, search (XSS), file upload	✓	✓	✓
Reconnaissance and OSINT
Subdomain scanning, Shodan and Censys	-	✓	✓
Dark Web monitoring (basic)	-	✓	✓
Advanced application testing (OWASP Top 10)
Manual business-logic testing	-	✓	✓
SQL/NoSQL Injection, all types of XSS, CSRF	-	✓	✓
IDOR, Authentication Bypass, Session Fixation	-	✓	✓
Infrastructure testing
Port scanning, service and version identification	-	✓	✓
Known vulnerabilities (CVE) and misconfigurations	-	✓	✓
Report and consulting
Automated report	✓	✓	-
Basic report	-	✓	-
Extended report with recommendations	-	-	✓
Configuration consulting	-	✓	✓
Continuous monitoring (12 months)
Monthly scanning and quarterly mini-pentests	-	-	✓
Vulnerability management platform	-	-	✓
Configuration hardening, good practice, threat analysis	-	-	✓

✓ included · - not included

How we work

From conversation to delivery

01
Scope

We jointly define goals, in-scope systems and time windows. We sign the agreement and testing authorisation.
02
Reconnaissance

We gather information about the environment - passively (OSINT) and actively. We map the attack surface.
03
Testing

We run manual and automated tests following the agreed scenarios. Critical vulnerabilities are reported immediately.
04
Report

You receive a report with prioritised actions and recommendations - clear to both management and IT.
05
Fixes and re-test

We help implement the fixes and verify their effectiveness with a re-test.

FAQ

Frequently asked questions

Services

How does a penetration test differ from a vulnerability scan?

A vulnerability scan is an automated comparison of software versions against a database of known flaws. A penetration test is an engineer actually trying to exploit those flaws (and business-logic errors a scanner cannot see) - just like an attacker would. CYBER PLUS and CYBER PRO combine both approaches.

Do the packages build on each other?

Yes. CYBER PLUS includes the full CYBER scope and CYBER PRO the full CYBER PLUS scope, extended with continuous monitoring and ongoing support from our Security, DevOps and Networks teams.

How long does it take?

CYBER takes 2-3 business days, CYBER PLUS 5-7 business days. CYBER PRO means 10 days of work every month plus 12 months of continuous monitoring.

What report do I receive?

CYBER comes with an automated report with prioritised actions, CYBER PLUS adds a basic report and configuration consulting, and CYBER PRO includes an extended report with recommendations and ongoing consulting.

Blog