Security audits

Audit versus penetration test

A test answers “can someone break in”. An audit answers “are we protected the way regulation and good practice require” — and where the gaps are. The two complement each other: test findings often feed the audit, and the audit shows what is worth testing.

Scope

• Review of current controls — identifying weak points and recommending improvements.
• Source code analysis — assessing application security at different stages of development, finding vulnerabilities and optimising safeguards.
• Network and system security — verifying configuration, resilience to attacks and compliance with industry standards.
• Processes and policies — procedures, business continuity plans, access and incident management.
• Vendors — assessing the security of partners and the supply chain.

NIS2, DORA, ISO 27001

We map the current state to the directive, regulation or standard, point out the missing controls and order them by risk impact and cost of implementation. Instead of a pile of documents you get a prioritised action plan — and support in carrying it out, including in talks with the external auditor.