We check before someone else does.
We audit the security, performance and compliance of your infrastructure. You get a report and a remediation plan with an order of work, not just a list of problems.
What is an IT security audit?
An IT security audit is a controlled check of how easily a company's systems can be attacked and what happens if someone tries. It covers security testing in agreed windows, a review of configuration, permissions and procedures, and an assessment against requirements such as NIS2, DORA, ISO 27001 or GDPR. It ends with a risk-ranked report and a remediation plan, followed by a retest after fixes.
Why "nothing happened" means nothing
No incident doesn't mean the systems are secure. It might mean nobody has tried yet, that an attacker didn't consider the company worth targeting, or that a breach is already underway and simply hasn't been noticed. Security is hard to judge from the inside, because the team that builds a system rarely thinks like someone trying to break it.
The most common gaps aren't exotic: old accounts with access nobody revoked, passwords reused across systems, updates postponed because installing a patch requires downtime. Individually they look minor. Together they form a path from first contact to full access.
We test systems under controlled conditions, the way an attacker would, but within an agreed scope and with no risk to production. The report shows not just what's wrong, but in what order to fix it, closing the paths that give the most access for the least effort first. After fixes are implemented, we check again to confirm they actually worked.
What the module covers
Security testing
Vulnerability scanning and controlled intrusion attempts.
Configuration audit
A review of servers, network and permissions for configuration errors.
Compliance & procedures
Verification against good practices and incident-response procedures.
Regulations: NIS2, DORA, ISO 27001, GDPR
We determine which requirements apply to your company and show what is missing for compliance. The report can be mapped to a specific standard or review.
Risk-ranked report
A clear list of findings sorted by real business impact.
Remediation plan
Concrete steps to implement, with priorities.
How the engagement works
Scope & consents
We agree on test scope, time windows and formal written consents.
Testing & review
Controlled security testing and configuration audit, with no risk to production.
Risk-ranked report
Findings sorted by real business impact.
Remediation & retest
A walkthrough, support in fixing issues and verification that fixes work.
What you get
This is what you get at the end. You can work with it from the next day, on your own or with us.
This module makes sense if…
You've never done a full security audit. You are preparing for ISO 27001 certification or an external review, or you fall under NIS2 or DORA. Or you simply want to know where you stand before an attacker tells you.
What changes
Findings in a typical mid-size infrastructure audit.
Production downtime during testing.
Readable for the board, not just the IT department.
Frequently asked questions
Can the tests break anything?
Testing is done under controlled conditions in agreed windows. Zero production downtime so far.
Do you help prepare for certification?
Yes. The audit can be mapped to the requirements of a specific standard or review, with a remediation plan built around them.
Who sees the results?
Only the people you designate. The report and findings are covered by an NDA.
Does the audit help with NIS2, DORA or ISO 27001 compliance?
Yes. We start by determining which requirements apply to you: NIS2 for essential and important entities, DORA for the financial sector, ISO 27001 for certification, GDPR for personal data. The report shows the gaps against those requirements and the order in which to close them. We do not issue certificates, but we prepare you for the certification audit or review.
Let's talk about your systems
No strings attached. 30 minutes to understand where you are and what makes sense next.