We find the gap before anyone else does.
- OWASP WSTG
- OWASP ASVS
- PTES
- NIST SP 800-115
- MITRE ATT&CK
- IEC 62443
- CVSS 4.0
- TLP 2.0
Services
Where attackers would start
From web applications to production line control. Every assessment answers the same question: what could a real attacker achieve, and what needs fixing first.
Application security
Web, API, mobile, thick client, AI and LLM applications, source code.
Network and cloud
External and internal networks, Active Directory, Wi-Fi, Azure, Microsoft 365, AWS.
OT and industrial systems
Passive assessment, controlled OT penetration testing, segmentation per IEC 62443.
People and physical
Phishing campaigns, voice phishing, physical intrusion testing.
Adversary simulation
Red teaming, purple teaming, threat modelling.
Continuous security
Quarterly testing, external attack surface monitoring, NIS2 follow-up.
Compliance
NIS2 quick assessment, ISO/IEC 27001 readiness, policies, business continuity.
Training
Awareness, OT, developer and executive training.
How an attacker thinks
One flaw is rarely enough. The chain is what hurts.
A scanner lists flaws one by one. We show how they chain together from entry to objective, following MITRE ATT&CK tactics. The report includes this path as a diagram.
- Reconnaissance
Discovery
Public subdomains, services, leaked data, staff.
- Initial Access
Entry
A vulnerable web interface, weak VPN access or a successful phishing e-mail.
- Privilege Escalation
Privilege escalation
Misconfiguration, stored credentials, certificate template flaws in Active Directory.
- Lateral Movement
Lateral movement
Servers, file shares, backups, the edge of the industrial network.
- Impact
Objective
Customer data, finance systems, production control. This is where business damage happens.
Approach
How an engagement works
The same six steps in every engagement. That is what makes results repeatable and comparable.
Scope
A short questionnaire and call, then a fixed price with no day-rate billing.
Authorisation
NDA, contract and written authorisation: systems, time window, emergency contact.
Testing
Within the agreed window. Critical issues are reported immediately, not just in the report.
Report
An executive summary in business terms and a technical section with reproducible steps and specific recommendations.
Retest
After remediation we verify the fixed findings.
Attestation
A one-page attestation letter without technical detail, for partners or auditors.
Development
Custom software development
Design, development and operation of web and mobile applications, websites, desktop and business software, and system integrations.
- Custom web application development
- Website development
- Mobile app development
- Desktop and business software
- API development and system integration
- Industrial software and data acquisition
- Process automation
- Support and operations
OT and industrial security
Where downtime means lost production
In industrial environments the first rule is not to disrupt production. We start with passive traffic analysis and document review; active testing happens only in a test environment or maintenance window, with separate written authorisation.
- IEC 62443zones and conduits, security levels
- NIST SP 800-82industrial control system security
- Purdue modelIT/OT boundary and remote access
NIS2
Received a questionnaire from a partner?
Organisations covered by NIS2 (in Hungary, Act LXIX of 2024) increasingly ask suppliers to demonstrate their security controls. A quick assessment shows where you stand and what to fix first.
NIS2 supplier quick assessment
- Questionnaire and interview
- Maturity score on a 30-point scale
- Prioritised 90-day remediation plan
- Fixed price, agreed up front
Blog
Latest analysis
What can a NIS2-regulated partner require from its supplier?
Which suppliers are primarily affected, what is mandatory, and what can be added by contract.
Executive guide · Web securityAutomated scanner or penetration test?
What each one finds, what it misses, and which fits your website or online shop.
Executive guide · BasicsFive questions for your IT administrator
What an executive can ask without IT knowledge, and what a good answer looks like.
FAQ
Before you get in touch
How long does an assessment take?
A smaller web application or external network takes a few tester days, and the report follows within a week. Testing can usually start 1–2 weeks after the signed authorisation.
How much does it cost?
It depends on scope: how many applications, IP addresses, sites or roles are in scope. After a short call we give a fixed price in writing, with no day-rate billing and no surprises.
Can testing take our systems down?
We test within the agreed window using safe settings. Denial-of-service or destructive tests are performed only on separate written request. In industrial environments we start with passive methods.
What do we need to provide?
A list of in-scope systems, test accounts per role where needed, a reachable contact and a fresh backup. We send the exact list when agreeing the scope.
What is the difference between a vulnerability scan and a penetration test?
An automated scanner looks for known issues and produces many false positives. In a penetration test every finding is verified by hand, flaws are chained, and we show what an attacker could actually achieve.
Do you perform the mandatory NIS2 vulnerability assessment?
No. In Hungary the mandatory assessment under Act LXIX of 2024 may only be performed by assessors registered with the SZTFH, and we are not registered. We provide voluntary testing, supplier readiness and internal assessments; these do not replace the mandatory assessment.
Who sees the report?
Only the people the client names. Reports are marked under FIRST TLP 2.0, delivered encrypted, with the password sent separately. We never name a client as a reference without written consent.