Service
What the scanner misses, a person finds.
A full assessment of the external attack surface, configurations, access rights and processes. Automation gives breadth, manual review gives depth.
- External surface
- Configuration
- Access rights
- Processes
Why it matters
The problem
An audit is not a scanner report. Scanning is only the starting point: it finds known vulnerabilities but does not see a wrongly granted permission, a forgotten service or a process that does not match the document.
Our answer
A security audit shows the organisation’s real state: what exists, what works, where the gaps are, and where to start.
What is included
06 modulesSecurity audit
- External surface
- Configuration
- Access rights
- Processes
- 01
External attack surface
Domains, subdomains, open ports, certificates, forgotten assets.
- 02
Configuration
Servers, network equipment, cloud resources, against secure-configuration standards.
- 03
Access rights
Who can reach what: excessive rights, shared accounts, access of former employees.
- 04
Processes
Backup, patching, incident response, staff access: on paper and in practice.
- 05
Prioritisation
Every finding is rated by impact and likelihood of exploitation: it is clear what to close first.
- 06
Roadmap
Fixes as a plan with deadlines and owners.
How it goes
04 steps
- 01
Scope
The list of systems, networks and processes and the boundaries are confirmed in writing.
- 02
Collection
Configurations, rights and documents are gathered; automated scanning is run.
- 03
Analysis
Manual review: findings are confirmed, risk is rated.
- 04
Report
Technical report, management summary, roadmap.
What you get
- 01
State report
What was found, how serious, how it is closed.
- 02
Management summary
In non-technical language: overall risk and three priority issues.
- 03
Roadmap
Order of fixes, deadlines and a retest plan.
Questions
All servicesHow is an audit different from a pentest?
A pentest finds and exploits a weakness the way an attacker would. An audit is broader: configurations, rights and processes are reviewed too.
Do you need access to the internal network?
The external surface is reviewed from outside. For internal coverage, limited access is agreed: VPN or on site.
How long does it take?
Usually two to four weeks, depending on the size of the organisation.
Is it suitable for a regulator?
Yes. The report is written with Law 547 and sector requirements in mind.
Let’s start
Start with a free external check
Give us your domain and we return a first report on your external attack surface and leaked accounts. Nothing is installed, nothing is blocked; the scope is agreed based on the result.
- Subdomains, open ports and expired certificates
- Corporate accounts found in breaches
- The three most important issues and where to start