The report is not the result. The remediation is.
Configuration review, secure SDLC review, hardening and compliance readiness — and the implementation too, if you want it. We are a software company: we can not only name findings but close them with your team. From €2,500.
Why the same findings come back every year
Put two pentest reports two years apart side by side and you often find the same items: missing access control in a new place, outdated dependencies, overly broad cloud permissions, secrets in the repository. That is rarely the developers' fault and almost always the surrounding system's — configuration standards that do not exist, reviews that never ask about security, a pipeline that lets everything through. An audit that only inspects does not fix this. So our work does not stop at the report: we examine the cause, propose concrete changes — and implement them with you on request.
Our audit and consulting services
Short, clearly bounded packages instead of open-ended consulting mandates
Configuration and hardening review
AWS, Azure, GCP, Microsoft 365, Kubernetes: permissions, exposed services, network rules, logging, backup security. 2 days, €2,500.
Secure SDLC review
How do vulnerabilities enter your software — and what catches them? Pipeline, dependencies, secrets, review practice, test coverage. 4 days, €4,900.
Architecture review
A security look at your system architecture: trust boundaries, tenant separation, authentication flows, data paths. Before you build rather than after the incident.
NIS2 readiness check
Assessment against the technically testable requirements of §30 BSIG, prioritised gap list, action plan with effort estimates. 2 days, €2,900. For the CRA, start with our free reporting-readiness check.
Developer workshop
Security training on your own findings instead of generic examples. Half a day to a day, following any audit or pentest.
Remediation support
We implement the fixes with your team or take them on entirely — as a software company with our own developers. Time and materials, day rate €1,250.
Audit and consulting by the numbers
Fixed packages, predictable effort
How an audit runs
Two days of review, one result you can act on
What is in scope, which access do we need, who is the contact? Usually a 30-minute call.
Read access to configurations, repositories or cloud accounts. We look at what exists before we assess it.
Comparison against hardening baselines, vendor guidance, OWASP and BSI IT-Grundschutz — combined with manual review of the critical areas.
Every item with risk, effort and impact — so you can decide what happens this week and what waits for next quarter.
Concrete changes instead of general recommendations: which setting, which value, which file, which owner.
A walk-through with your team rather than a PDF by email. Questions get answered where they arise.
You implement, we support selectively, or we take remediation on completely. Afterwards we verify.
Why our audit ends differently
Not with a recommendation but with a change
We can implement
The decisive difference to a pure security boutique: if you lack capacity, our developers take on remediation — within the same engagement, without onboarding another vendor.
Concrete, not generic
No recommendations in the conditional. We name the setting, the value, the file and the order — verifiable and traceable, including for auditors.
Small packages, fast results
Two days of review, the result a few days later. No consulting mandate that drags on for months until nobody can name its value.
Connects to the pentest
Audit and penetration test interlock: the test finds what is exploitable, the audit explains why it could arise. Together that is root-cause remediation.
Usable as evidence
Results are documented so they can be used in NIS2, ISO 27001 or TISAX contexts — including tracking of the agreed measures.
Knowledge transfer included
The closing workshop is not an extra but part of the engagement. Your team should avoid the next mistake themselves rather than wait for us.
Audit and consulting pricing
Fixed packages — no day-rate surprises
Security audit
Configuration and hardening
- Cloud, infrastructure or M365 review
- Permissions and network rules
- Logging and backup security
- Prioritised action plan
- Handover workshop included
Secure SDLC review
The cause, not the symptoms
- Pipeline and build process
- Dependencies and SBOM maturity
- Secrets and access management
- Review and testing practice
- Sample code review
- Developer workshop included
NIS2 readiness check
For companies under NIS2
- Assessment against the testable requirements
- Prioritised gap list
- Action plan with effort estimates
- Management summary
- Recommendation for the testing scope
Frequently asked questions on audits and consulting
Clarified before you engage
The penetration test attacks: it checks from outside or inside what is actually exploitable. The audit looks inward: configuration, architecture, processes, permissions. A test finds the open door; the audit explains why the door was built and how many more exist. Combining both fixes causes instead of symptoms — which is why both are part of our Security Cycle.
For a cloud or M365 review, read permissions on configuration and logs are usually enough. For a secure SDLC review we need visibility into the repository, pipeline definitions and dependency management. Scope and duration of access are agreed in writing, all access is personalised, and it is revoked when the engagement ends.
Yes, and that is the difference to a pure assessment firm. Our developers can implement configuration changes, dependency updates and authentication or authorisation work directly — either alongside your team or fully in our own responsibility. Billed time and materials at a day rate of €1,250.
No. We are neither a certification body nor an auditor in the sense of the standard. What we deliver is the technical substance such an audit relies on: reviewed configuration, documented measures, traceable improvement. For certification itself we work with specialist partners.
For a two-day audit you usually receive the report within five working days of the review ending. Critical findings are reported immediately, not held for the report. The handover workshop typically happens in the week after the report is sent, while the findings are still fresh.
Especially then. Under deadline pressure the minimum gets documented; without it, what actually carries risk gets fixed. In our experience the most effective measures are neither expensive nor laborious — they simply never got prioritised because nobody looked for them systematically.
Two days, one actionable result
Let's look behind the symptoms
In the intro call we define the review scope and tell you whether an audit, a secure SDLC review or a penetration test first delivers the greater value.
Yen Ngoc Phan · Manuel Gruschka