Start with an audit. See where you stand.
Two independent audits: technical and security. Each ends with a report and a to-do list ordered by importance. You can act on it yourselves, with your current vendor, or with us.
What do you want to check?
IT audit
When you want to know the state of your technology, what it costs and what threatens downtime.
Security audit
When you are preparing for certification or an external review, or have never checked how easy you are to attack.
Which audit to start with?
You don't know the state of your technology
Costs grow, failures repeat, you are taking over IT from a previous vendor or planning a migration. Start with the IT audit.
You are preparing for certification or an external review
Or you have never checked how easy you are to attack. That is a job for the security audit.
You want to see the whole picture
Then we run the IT and security audits in one project. The first shows the state of the technology and costs, the second tests resilience to attack.
The two audits side by side
| What we check | IT audit | Security audit |
|---|---|---|
| Infrastructure and architecture: servers, network, cloud | Yes, in detail. We check servers, network and cloud environments, looking for oversized resources and single points of failure that could stop the business. | Indirectly. We look at infrastructure configuration purely from a security angle, not its performance or cost. |
| Costs, licences and vendor contracts | Yes. We review contracts, licences and resource usage to show where you overpay and what nobody uses anymore. | No. This audit doesn't cover costs or licences, only system security. |
| DevOps processes, CI/CD and deployments | Yes. We check how a code change reaches production, looking for bottlenecks, manual work and missing tests. | No. The deployment process is outside the scope of a security audit. |
| Backups and business continuity | Yes. We check whether backups are complete, tested and restorable within a reasonable time. | Partly. We assess whether backups themselves could be a way in for an attacker, but we don't test the restore process. |
| Security testing and intrusion attempts | No. The IT audit only covers basic hygiene: accounts, permissions, patching. | Yes. We run full security testing and controlled intrusion attempts in agreed time windows. |
| Compliance with NIS2, DORA, ISO 27001, GDPR | No. The IT audit doesn't assess compliance with specific regulations. | Yes. We determine which requirements apply to you and show what's missing for compliance. |
| Documentation and procedures | Yes. We check whether restore instructions, emergency procedures and ticket handling are documented. | Yes, but narrower. We only assess security incident-response procedures. |
| What you get | A report with a to-do list ordered by importance, effort estimates and a separate list of quick fixes you can act on right away. | A risk-ranked report sorted by real business impact, plus a remediation plan with a sequence of work. |
| Follow-up check after fixes | Not standard for this audit, but a short check after you implement the recommendations can be arranged separately. | Yes. A retest after fixes is part of the audit: we verify that the reported vulnerabilities were actually closed. |
| Duration | 2-4 weeks, depending on the size of the environment and scope. | 2-3 weeks, plus time to implement fixes before the retest. |
How we work on every audit
We don't get in the way
Read-only access, conversations and documents. We change nothing in your environments.
A report for IT and for the board
A short summary for the board: risks, money, order. Technical detail for the team separately.
Priorities and estimates
Every recommendation has a weight, an effort estimate and a place in the sequence. You know what to do first.
The decision is yours
An audit isn't a disguised sales pitch. You can implement the report yourselves, with your current vendor, or with us, hardware and licence supply included if you want it.
From the first meeting to the report walkthrough
Kickoff
Scope, access and what matters most to the business. One meeting.
Analysis
A review of environments, documents and contracts, and conversations with the team. No interruption to work.
Report
Findings and recommendations with priorities, effort estimates and sequence.
Walkthrough
We go through the report with your team and management and agree on the first step.
Not sure which audit to start with?
A free 30-minute call is enough. No obligations and no sales presentation.