The security check
A check sized to your business, priced to the work.
For companies that run on SaaS, have devices in offices, and have either no security team or a stretched one. We agree the scope with you, probe it the way an attacker’s agent would, and hand you a ranked list of what to fix. Remote by default. Onsite when the scope needs it.
Tell us what you run and how many people you are. We reply with a scope and a quote, in plain language, usually within 2 working days.
What you receive
Findings you can act on. Not a document you file.
- A ranked findings list. What an attacker’s agent reaches first, each with the evidence, what it means for the business, and the fix.
- A one-page summary for leadership. The three things to decide, in the language of the business.
- The log of everything we tried. Yours to keep, and to show your insurer, auditor or board.
- A walk-through call with whoever will do the fixing: your team, your IT provider, or both.
- A re-test after the fixes, on the same scope, with that month’s models.
- Scope Any of the four: physical devices, online services, SaaS applications, human processes. Most first checks take two or three.
- Duration Typically 2 to 3 weeks from signed scope to walk-through, depending on size. The re-test is scheduled with you.
- Where Remote by default. Onsite for the office network, the devices and the people, or whenever you prefer it.
- Price Negotiated per engagement, following the amount of work in the agreed scope. You see the price before anything starts. No percentage of anything, no scare pricing.
- Who from your side One decision-maker, one technical contact (in-house or your IT provider), and for the human-process scope, whoever owns the process being tested.
- Where your data goes Findings and logs are stored in the EU and deleted on a schedule we agree. Nothing from your systems is used to train anything.
Rules of engagement
What we always do, and what we never do.
- Written authorisation, signed by someone entitled to give it, before the first probe.
- Read only by default. We prove a way in; we do not walk through it and change things.
- Human-process tests only with consent on file and limits agreed in advance, including who is told afterwards and how.
- Every action logged and handed over.
- Findings go to you and nobody else.
- No destructive tests, no denial of service, no touching production data beyond proving it is reachable.
- No 24/7 monitoring or managed security operations. We assess, advise and re-test; we do not run your security for you.
- No building or operating AI on your behalf, in line with our consultancy as a whole.
- No fear-based selling. If your exposure is small, the report says so.
Questions
Asked before most first checks.
Is this a penetration test?
It overlaps. A classic pen test checks a defined technical target against known techniques. We check what an attacker’s agent would reach today, with today’s models, across devices, online services, SaaS and people, and we rank by what matters to the business. If you already have an annual pen test, this sits beside it.
Will it disrupt our work?
It should not. Probing is read only by default and scheduled with you. Human-process scenarios are agreed in advance with the people who own the process. If something would be noticeable, you know before it happens.
Do you need access to our systems?
For the outside-in part, no. For SaaS applications we ask for a read-only reviewer role so we can see configuration, sharing and app grants. For devices and the office network, onsite access or a supervised remote session.
Can you also fix what you find?
We advise and enable. Your team or your IT provider makes the changes, with us on the call or onsite as needed, and we re-test afterwards. We do not take over operating your systems.
We are in Germany. What about the works council?
Testing processes that involve employees can require the works council’s involvement. We raise this at scoping and help you prepare it. Nothing involving staff runs until it is settled.
How often should a check be repeated?
The models the attackers use change roughly monthly, and your systems change too. A re-test after fixes is part of every check. Beyond that, most businesses are well served by a check a year, sooner after a major change such as a new SaaS platform or a merger.
Start
Tell us what you run. We tell you what a check covers and costs.
Three lines are enough: what your business does, roughly how many people, and what you run on. We come back with a proposed scope, a duration and a price.