Ethical hacking and security assessment
Point-in-time or continuous penetration testing and proactive security assessment. Every service has a fixed scope, a standard methodology and the same deliverables: an executive and technical report, findings on the client platform and a retest within 60 days. We build on proven international standards and complement them with hands-on experience from our own lab.
Application Security
Applications are an organization's most visible surface and usually the first thing attackers target.
A1Web application pentest
Authentication, session handling, authorization (IDOR), injection, SSRF, file upload and business logic, from every role. Based on OWASP WSTG and ASVS L1/L2.
A2API pentest
REST, GraphQL, SOAP and WCF. BOLA/BFLA, mass assignment, rate limiting, excessive data exposure, JWT/JOSE flaws (OWASP API Security Top 10).
A3Mobile application pentest
Android (Google and Huawei HMS) and iOS: data storage, communication, certificate pinning, root/jailbreak detection, MDM environments (OWASP MASVS), together with the backend API. Gray-box gives the best turnaround.
A4Thick client
Desktop .NET, Java and Electron applications: traffic, local data storage, DLL hijacking, direct database connections.
A5AI / LLM application
Chatbots, RAG systems and AI agents: direct and indirect prompt injection, data leakage, tool-call abuse (OWASP LLM Top 10).
Infrastructure
Network and identity are the path of most incidents: this is how an attacker reaches the crown jewels.
B1External network pentest + ASM
Attack surface discovery, VPN and remote access portals, exposed admin interfaces, subdomain takeover, e-mail security.
B2Internal network + Active Directory
We start from an ordinary employee account and show how far an attacker can get with it: Kerberoasting, ADCS (ESC1–8), NTLM relay, delegation, shares, SQL Server. The step before a red team, with a path-to-Domain-Admin diagram.
B3Wi-Fi security
Corporate WPA2/3-Enterprise, guest network isolation, RADIUS configuration, rogue access points.
B5Workstation and lost laptop
Disk encryption, local privilege escalation, USB device control, EDR evasion resistance, stored credentials.
B6802.1X / NAC and segmentation
From a free wall port: bypassing network access control, VLAN hopping, validating reachable zones.
E1Red Team and Purple Team
Rather than individual bugs, we test the organization's immune system: does it detect a realistic attack chain (MITRE ATT&CK), can it stop it, and how fast does it recover. As a purple team we measure together with your defenders what the EDR and SIEM actually see.
Cloud and Microsoft 365
For most small and mid-sized companies, Microsoft 365 is the most important system: mail, documents and identity.
B4Microsoft 365 / Entra ID review
MFA coverage, Conditional Access, legacy authentication, admin roles, OAuth consents, mail forwarding, audit logging, external sharing.
B4Azure / AWS / GCP
Azure, AWS, GCP and Oracle Cloud: IAM and privilege escalation paths, public resources, network rules, logging, backups. Infrastructure-as-Code (Terraform, Bicep) review. We work layer by layer, which is faster and cheaper.
OT / ICS Security
In manufacturing a cyberattack is not only about data: machines, scrap, downtime and human safety are at stake.
C1OT baseline assessment (passive)
Interviews, site walk-through, passive traffic capture from a mirror port. Deliverables: asset inventory, communication matrix, Purdue / IEC 62443 zone model, remediation roadmap. We do not touch the controllers.
C2OT pentest (controlled)
Only in a test environment or a maintenance window, with written OT authorization: IT→OT reachability, engineering workstation, HMI, PLC access protection, OPC UA security mode.
C4IoT and embedded devices
The whole ecosystem: device, firmware (reverse engineering, hard-coded credentials, update chain), mobile app, cloud backend and hardware interfaces (UART, JTAG, SPI). For vendors before release, for operators at procurement.
C3Segmentation design and validation
Zones and conduits (IEC 62443-3-2), IT/OT DMZ, secure vendor remote maintenance; then we validate that traffic really cannot cross.
Continuous Services
Your attack surface keeps changing between engagements, so we keep watching it.
F1ASM Basic
Weekly external discovery and scanning, alerts on new subdomains, ports and critical findings, monthly report on the portal.
F2ASM Plus
Everything in Basic, plus manual validation of critical findings, a quarterly executive report and one day of external pentesting per quarter.
F3Continuous pentest
Smaller quarterly tests of new features and changes, retests and trends on the portal.
F4NIS2 retainer
Quarterly review, phishing simulation, annual reassessment and documentation for your next audit.
NIS2, Advisory and Training
We complement technical testing with process, accountability and awareness measures.
G1NIS2 supplier quick assessment
A maturity score against the ten NIS2 minimum measures, a technical quick check, a 90-day remediation plan and truthful answers to your partner's questionnaire. Not an official audit: we prepare you for it.
G2Architecture review
Threat modelling (STRIDE) based on the design, before development or procurement, when issues are cheapest to fix.
G3Remediation support
Consultation with developers and operators, hunting for bug variants, security requirements, regression test cases.
D1Phishing simulation
An agreed campaign with aggregated statistics and no naming and shaming, followed by targeted training.
G4Training
Cyber security awareness (with quiz and certificate), OT security for plant staff and maintenance teams, NIS2 for executives.
Cost-efficient scoping
For identically configured devices and images, testing a sample is enough. Where there are many roles, we choose a representative minimum. A gray-box test (documentation and accounts) gives deeper results in the same number of days than a black-box test. In the cloud we work layer by layer.
Request a proposal
Briefly describe the system you would like tested and the reason for the engagement: a partner or regulatory requirement, an audit, or a new system going live. We will get back to you within one business day.