01
Penetration testing
Websites, web apps, APIs, networks and cloud: we hunt for vulnerabilities by hand, prove they can be exploited and rank them by risk.
Home / Cybersecurity
Service · Cybersecurity & infrastructure
Security that holds up – not just on paper.
We test your systems the way an attacker would, step in fast when something goes wrong – with every step documented – and run infrastructure that simply works. With results that management, legal counsel and IT can all understand.
Services
Attack, secure, operate.
We find what scanners miss and write it up so that everyone involved speaks the same language.
02
Security audits
Configurations, access, permissions and processes: an honest assessment with clear next steps – not a report nobody reads.
03
Incident response
Ransomware, compromised accounts, data exfiltration: contain the damage, preserve the evidence, find the root cause and get back up and running cleanly.
04
Hardening & compliance
Hardening your systems and preparing the technical evidence – for example ahead of ISO 27001 certification or for NIS2.
05
System administration
Setting up, securing and maintaining production Linux servers: updates, access, networks and documentation that stays up to date.
06
Backup & monitoring
Backup and recovery plans that actually work when it counts, and monitoring that spots problems with critical services before your customers do.
Day-to-day operations matter too.
Monitoring flags problems before your customers notice them. And if something does fail, regularly tested backups bring your systems and data back reliably.
Typical cases
When people call us.
- Suspected data leak or compromised systems
- A pentest before an application goes live
- Ransomware attack: what happened, and what’s affected?
- Hardening ahead of an ISO 27001 or NIS2 audit
- Setting up, hardening and looking after Linux servers long term
- A backup and disaster-recovery plan that has actually been tested
- Monitoring and alerting for critical systems
- Moving from the cloud to your own data centre – or the other way round
Process
How a pentest works.
A clear scope up front, traceable results afterwards.
- Agree the scopeWhich systems, which goals, which time window – agreed in writing before we start.
- TestingManual testing, backed up by tools. Critical findings are reported immediately, not saved for the report.
- Prioritised reportEvery vulnerability with evidence, a risk rating and a concrete recommendation – plus a summary for management.
- Fix & retestIf you like, we help put the fixes in place and then check that the gaps are really closed.
If something has already happened
Security and forensics from one team.
After an attack, two things matter: getting systems back up quickly and properly documenting what happened – for insurers, the authorities and any legal proceedings. Because we do digital forensics too, nothing gets lost along the way.
FAQ
Questions we hear a lot.
What’s the difference between a pentest and a vulnerability scan?
A scanner automatically flags known vulnerabilities. A penetration test goes further: we check by hand whether weaknesses can actually be exploited and chained together, test business logic and permissions, and back up every finding with evidence. False positives are weeded out.
What should we do during an active attack?
Don’t rush to wipe or rebuild anything – you’ll destroy the evidence. Disconnect affected systems from the network, but leave them switched on if you can, and contact us straight away. If personal data might be affected, keep the GDPR reporting deadline in mind: usually 72 hours.
Does NIS2 apply to us?
NIS2 covers many medium-sized and large companies in key sectors and requires demonstrable risk-management measures. Whether it applies to you depends on your sector and size. We handle the technical side – assessment, hardening, evidence – while your legal advisers are best placed to confirm whether you’re in scope.
Do you test live systems?
Yes, by arrangement – with a clearly agreed scope and time window so day-to-day operations aren’t disrupted. Critical tests are agreed individually in advance.
Do you also look after servers long term?
Yes – from setup through updates, backups and monitoring to documentation, so knowledge never depends on a single person.
Next