For companies and IT teams
Security audit of systems and processes
Find out whether your systems and processes are set up securely. We review configuration, access management and how you develop software, then describe the weaknesses and what to address first. An audit is useful even if you do not yet have your own application to penetration test.
Discuss a security auditWhat the audit covers
We choose the scope based on how your company works and what you want to learn. We usually combine several areas.
System and cloud configuration
Settings of cloud services, servers, networks and company accounts. We look for incorrect permissions, unnecessarily exposed services and defaults nobody changed.
Processes and access
Who has access to what, and how access is granted and revoked. Asset inventory: do you know which systems and data you have and who is responsible for them?
Development and AI usage
Security of the development process (SSDLC), such as code review, dependency management and secrets handling. How your company uses AI tools and what data goes into them.
What you receive
- A report of findings with an explanation of why they are a risk.
- Recommendations ranked by priority, so you know what to address first.
- A basis for deciding whether and where a follow-up penetration test makes sense.
How the audit works
Agree the scope
We discuss how your company works, which systems you use and what you want to learn. We choose the audit areas and the access needed.
Review systems and processes
We check system configuration and talk to the people who administer or develop them.
Deliver the report
We summarise the results in a report and discuss with your team what they mean and how to proceed.
Agree the next steps
We decide which findings to address right away. If testing a specific application makes sense, we propose a penetration test scope.
What we build on
Infrastructure and cloud
Petr is a DevOps architect with more than 10 years of experience who manages infrastructure for several enterprise clients.
An attacker’s view
Martin has worked in IT security for over 20 years, and Matej spent almost four years as a penetration tester at NÚKIB. In an audit, we know what an attacker would look for.
Long-term clients
We have tested the Liferay DXP platform every year since 2020. Most of our clients come back every year.
Common questions
How does an audit differ from a penetration test?
A penetration test checks whether an attacker can get into a specific application or network. An audit reviews configuration and processes across the company. If you have your own application or API, start with a test. If you want to know whether your systems and access are set up securely, start with an audit.
How much does an audit cost and how long does it take?
A typical audit takes about 40 hours of work, and the price depends on the number of hours. We send an exact price in our quote after the initial consultation. We are a nonprofit association and not VAT-registered, so the price in our quote is final.
What will you need from us?
Access to the systems the audit covers and time from the people who administer them. We sign an NDA and a framework agreement before starting.
What language is the report in?
English by default, because most of our clients want it that way. On request, we prepare the report in Czech or Slovak.
How do you handle data?
We delete raw audit data when the engagement ends. We keep the report so we can build on it in the next audit or test.
What do you want reviewed?
Tell us which systems you use, how many people in your company work with data and what concerns you. The initial 30-minute consultation is free.
Discuss a security auditDo you have your own application or API?
Application and infrastructure penetration testing