Cyber security
We find security gaps before attackers do – in your website, application, network, Wi-Fi or email – and help you close them. You get a report that both management and IT understand.
7 years of experience · Written authorisation and NDA · OWASP and PTES methodology · free retest within 30 days
Illustration. In a real report every finding comes with a description, evidence and remediation steps.
Experience
We have worked in cyber security for seven years. Today we combine that expertise with AI technology, so testing is faster and more thorough – while an expert still makes the calls.
7years of experience in cyber security
What we test
We build our own SaaS products and look after servers and networks every day, so we know where systems usually give way – and how to fix them, not just report them.
Login, user accounts, forms, payments and APIs – following the OWASP Top 10 and the OWASP WSTG methodology.
Everything visible from the internet: public IP addresses, open ports, VPN, RDP, mail server and DNS.
What an attacker could do once inside the office or on one infected computer – from shared folders to admin rights.
Password strength, guest network isolation, rogue access points and the path from Wi-Fi to the office network.
Two-factor sign-in, admin roles, document sharing, mail rules and SPF, DKIM and DMARC.
A simulated phishing attack and short training – because most attacks start with a single click on the wrong link.
For penetration testing we use Kali Linux with the standard commercial and open-source toolkit, and AI for faster analysis of the results. Not every tool is used with every client – we choose them based on the request and the scope of the test. Tools find possible issues; we verify every finding by hand before it goes into the report.
What it looks like
Packages
A security check-up is enough for most small offices. A penetration test makes sense once you run an online shop, an app or hold sensitive client data. After a short call about the scope you get a fixed quote.
For small offices with up to 5 computers. A check of the most common weak spots, done in a day.
from€290
For companies with up to 25 employees: where you stand today, what threatens you and what to fix first.
from€790
A hands-on test of your website, application or network – the way an attacker would do it, but with your written permission.
from€990
Pricing
Prices depend on the scope: the number of pages and user roles in the app, IP addresses, computers or employees. You always get a fixed quote before we start.
| Security check-up for small offices (up to 5 computers)network and Wi-Fi, passwords and 2FA, email, backups, website | from €290 |
|---|---|
| External vulnerability scan (website and public IP addresses)automated tools with manual verification of findings | from €190 |
| Cyber security assessment (up to 25 employees)based on CIS Controls and the Croatian Cyber Security Act | from €790 |
| Preparing for the Cyber Security Act (NIS2) self-assessment | from €1,200 |
| Penetration test of a website or online shopincludes a retest within 30 days | from €990 |
| Penetration test of a web application or APIwith test user accounts (grey box) | from €1,900 |
| External penetration test (up to 5 public IP addresses) | from €1,200 |
| Internal network and Active Directory penetration test | from €2,400 |
| Wi-Fi penetration test (one location) | from €390 |
| Microsoft 365 / Google Workspace security review | from €390 |
| Phishing simulation with training (up to 25 employees) | from €490 |
| Cyber security workshop for employees (2 h) | €250 |
| Additional day of security testing | €480 / day |
| Security consulting (1 h) | €60 |
How we work
We agree on what to test, the goals and the timing. Then you get a fixed quote.
Scope, rules of engagement, NDA and an emergency contact – signed before the first test.
We work in the agreed window and take care not to disrupt your business. Critical findings are reported straight away.
A management summary and a technical part for IT, with priorities and remediation steps.
Once you have fixed the issues, we re-check the findings for free – within 30 days.
We can also fix the issues ourselves – we look after servers, networks, Microsoft 365 and websites every day anyway.
Why small businesses too
Most attacks on small businesses are not targeted. Automated tools look for easy targets, and a small office with an outdated WordPress site or open RDP is exactly that.
Bots scan the whole internet around the clock for known vulnerabilities and weak passwords – and find them within minutes.
Article 32 of the GDPR requires regularly testing and evaluating your security measures. A report shows that you do.
Essential entities must be audited, and important entities must self-assess, at least every two years. We help you prepare and put the measures in place.
Larger clients, tenders and cyber insurance policies increasingly ask for proof of security testing.
Questions
A scan is automated and finds known, surface-level issues – it is quick and affordable, but produces false positives. In a penetration test an expert manually tries to exploit and chain the weaknesses, as a real attacker would, and finds flaws in the application logic that no scanner can see.
Yes, just on a smaller scale. Most attacks on small businesses are not targeted – bots look for easy targets. A security check-up is usually enough for a small office; a penetration test makes sense once you run an online shop, an app or hold client data.
We plan tests so they do not disrupt your business: risky checks are avoided or run outside working hours, and on request we test a staging environment. If we find something critical, we tell you straight away, not just in the report.
We only test with written authorisation from the system owner, with an agreed scope and time window. If someone else runs your site or server (hosting, cloud), we check their rules too. From you we need a contact person and, for application tests, test user accounts.
A security check-up usually takes a day, a website penetration test 2–3 days, and larger applications and networks 5–10 days. You receive the report within 5 business days of the testing.
We sign an NDA, handle data in line with the GDPR and access only what is needed to prove a finding. The report is sent password-protected, and test data is deleted when the project ends.
Yes, as an assistant. AI helps us review scan results, configurations and code faster, connect findings and prepare the report. The decisions stay with the expert: we verify and confirm every finding by hand. We do not send confidential data – passwords, personal data or documents – to public AI services.
The Act (NN 14/2024) covers medium-sized and large organisations in sectors such as energy, transport, health, digital infrastructure, manufacturing and public administration – and some regardless of size. Essential entities must be audited, and important entities must carry out a self-assessment, at least once every two years. The official audit is done by certified auditors; we help you prepare and put the measures in place. Not sure whether you are in scope? We will check together on the first call.
Possibly. In 2025 CARNET’s National Coordination Centre (NKS) ran a call to improve the cyber security of micro, small and medium-sized enterprises – grants of €7,500 to €60,000 covering 50% of eligible costs, with security testing among the supported activities. A new round has been announced; if you apply, we will prepare a quote and an activity description for your application.
pl contact --new
Get in touch for a free first call – we will agree on the scope and send a fixed quote. Everything you tell us stays between us.