For companies Security baseline check
The starting point for businesses that have never been tested: we look at your organisation from the outside and tell you in plain language where you stand.
- Who we serveBusinesses with between 10 and 150 employees that have no IT security department of their own.
- The key questionWhat does an attacker see before they even start – and how far would they get with what is exposed?
- What you have afterwardsA list sorted by effort. What can be fixed today at no cost is at the top.
Security baseline check
- Complete mapping of your systems reachable from outside
- Matching your addresses against known data leaks
- Review of Microsoft 365 baseline settings for the most common gaps
- Quick check of the website for outdated software and missing encryption
- Report in plain language plus a technical appendix for your IT provider
How it works in practice.
Mapping
Domains, subdomains, mail servers, remote access, cloud storage – everything that points to your organisation.
Assessment
Which of it is a real risk and which is just noise? We sort it rather than passing on a scanner list.
Review meeting
We go through the result with you – together with your IT provider if you wish.
Roadmap
You get an order of priority, not a wish list. Immediate measures first.
The analysis of freely available sources. We gather what is already on the internet about your organisation – the way an attacker would at the start. The abbreviation stands for "Open Source Intelligence" and has nothing to do with open-source software.
At no point do we send a request to your systems. Everything comes from third parties who hold this information anyway. That is why there is no risk of outage, no alarms and no need to coordinate with your IT.
When a provider has been hacked, addresses and passwords often turn up in collections that are traded. We check whether your addresses appear there – and above all whether that is still a risk today or an old finding without consequences.
A test system or an old project page that nobody looks after any more but that can still be reached from the internet. Because nobody misses it, a break-in there goes unnoticed too.
What is included – and what explicitly is not.
Typical scope
One company with one main domain and up to three sites.
Duration
Two to three working days, report and review meeting within one week.
Prerequisite
A written commission. We don't need access to your systems for the baseline check.
Not included
No internal test, no entry attempt, no implementation of the measures.
The baseline check is a snapshot from the outside. It doesn't replace an internal test and says nothing about how far someone would get who is already on the network.
What people ask beforehand.
That is exactly when it makes sense. Your provider builds and operates, we test independently of that. This is not distrust but the four-eyes principle. Many providers welcome the report because it gets them budget for things they recommended long ago.
The baseline check works passively and from the outside. It shows the attack surface but doesn't exploit anything. A pentest goes one step further and tests how far one actually gets. The baseline check is the cheaper starting point for deciding whether the larger test is worthwhile.
No. We don't send any requests to your systems, there is no load, no alarms and no risk of outage. You don't need to plan a maintenance window.
The scope is small and clearly defined, so we give you the price in the free intro call as soon as we know your size.
More offers for you.
Security baseline check
The starting point for businesses that have never been tested: we look at your organisation from the outside and tell you in plain language where you stand.
Red team engagement
Building and network in one engagement: we try to get in – physically and digitally – and document every step.
Phishing simulation & training
A realistic simulation, followed by a short training session based on the real cases from your organisation – and a second measurement that shows whether it worked.
Access, POS and Customer Data Check
For studios with access outside staffed hours, practices, workshops and restaurants: we look at where people actually get to — and what is there.
What we encounter in assessments, before you encounter it.
Not a product newsletter. We write about attack paths that actually worked against Austrian businesses, authorities and schools – and what helps against them.
- About once a month, not every week
- Concrete attack paths from real assessments
- No tracking pixel, no sharing with advertisers
- Unsubscribe with one click in every email