Security consulting

The cheapest fix is the one you make on paper. Show us the design of a new customer application before development and we walk through the data flows with STRIDE and name where risk arises: in authorization between roles, in tokens for integrations, and in an administrator interface exposed to the internet. Half a day over a diagram saves rewriting a module in production.

The second moment is choosing a vendor or a tool. A requirement like “will provide cybersecurity” in a brief has no criterion for saying whether the vendor met it, so its interpretation can be argued over for months. We help you write requirements that can be measured: which logs the vendor hands over, how often testing happens, what the deliverable looks like, and who holds the encryption keys.

The third is the situation after an incident or after a test by another company. We go through the report, separate the findings that are a real threat from the ones a scanner dumped in, and propose a remediation priority by how many paths each one closes to an attacker.

The format is a call or a half-day workshop, not a hundred-page document. We request materials in advance (a network diagram, a list of exposed services, an overview of administrative accounts, possibly an older report) and come with questions, not a blank notepad. The first session usually takes two to three hours.

The deliverable is a write-up of up to five pages: recommended decisions, risks that remain open, and the order of steps for the next quarter. Each step has an effort estimate and a note on who can handle it: your team, a vendor, or us.

Where it makes sense to verify an assumption, we propose a targeted test instead of another meeting. A one-day check of a single hypothesis, say whether an ordinary workstation can reach an administrative share, settles the discussion faster than three meetings and costs less than a month of delay.

A consultant who doesn’t test can only lean on what the standard says. We add what actually makes an attacker’s job harder and what doesn’t. Disabling NTLM where it’s no longer needed, separating administrative accounts into their own tier, and cleaning up delegations in the domain move your defense further than another tool in the security operations center. Whether that holds in your environment is what a test of the Active Directory and Microsoft Entra ID design verifies.

We’ll just as readily tell you when a measure is pointless. There’s no sense paying for detection of exotic techniques while half your servers share the same local administrator password and the domain allows delegation that an ordinary account can abuse.

Regulation feeds into these decisions continuously. Act No. 264/2025 Coll., on Cybersecurity (the Czech Cybersecurity Act), by which the Czech Republic transposed the NIS2 Directive (Directive (EU) 2022/2555), has been in effect since November 1, 2025 and changes what some companies have to document. Whether it applies to you and what exactly it asks of you is written up in our overview of which regime a company falls into and what follows from it, and separately in the glossary on when a security audit is enough and when you need a test.