Verified findings
Results from automated tools are checked manually. Reports contain only findings backed by evidence; anything that cannot be confirmed is marked separately.
About
IT security and software development
Bastinet provides IT security testing, advisory, training and software development to businesses, public bodies and industrial organisations, in Hungarian and English.
What we do
In security, we provide penetration testing, red teaming, industrial (OT) security assessments, NIS2 readiness and training. The aim is to give clients an accurate picture of which issues pose real risk and in what order to fix them. Details: Services.
In development, we design, build and operate web and mobile applications, websites, desktop and business software, and system integrations. Details: Development.
Our principles
Clear results
The executive summary describes risk in business terms; the technical section contains reproducible steps and specific recommendations.
Controlled execution
We work within an agreed scope, time window and emergency contact. In industrial environments we start with passive methods.
Confidentiality
Engagement details are treated as trade secrets; clients are named as references only with written consent.
Lawful and ethical practice
- Written authorisation. Security testing starts only with a signed authorisation that defines the systems, time window and permitted methods. Unauthorised testing of an information system may constitute a criminal offence under Sections 423–424 of the Hungarian Criminal Code.
- Confidentiality. We sign a non-disclosure agreement on request, deliver reports encrypted and mark documents under FIRST TLP 2.0.
- Data protection. Where personal data becomes accessible during an engagement, we act as the client's processor under Article 28 GDPR, based on a data processing agreement.
- Responsible disclosure. We do not publish vulnerabilities found during engagements. Issues in third-party products are reported to the vendor only with the client's consent.
- Regulatory status. We are not registered with the Supervisory Authority for Regulated Activities (SZTFH) as a vulnerability assessor, so we do not perform the mandatory assessment under Hungarian Act LXIX of 2024. Our assessments are voluntary.
- Business clients only. Our services are provided to businesses and organisations, not to consumers.
Full terms are set out in the Terms and Conditions and the Privacy notice; provider details are in the Legal notice.
Artificial intelligence
We may use AI-based tools for certain steps of testing and development, such as automating discovery, analysing logs and tool output, or drafting documentation. Findings, severity ratings and recommendations are always reviewed and approved by a professional; no AI tool performs actions on client systems on its own.
Client confidential data is shared with a cloud AI service only with the client's prior written consent, minimised, and via a provider that does not use it for model training. See point 10 of the Terms.
Methodologies and standards
Our work is based on the following public methodologies and standards: OWASP WSTG, OWASP ASVS and OWASP MASTG; PTES; NIST SP 800-115; MITRE ATT&CK; and in industrial environments IEC 62443 and NIST SP 800-82. Findings are rated with CVSS and documents are marked under FIRST TLP 2.0. Reference to these standards does not imply certification or accreditation.
The name
In IT, a bastion host is the hardened gateway into a protected network; in fortification, a bastion is the best defended, projecting point of the wall. The name reflects our focus: the points where a system's defence is decided.