---
title: "Security audits"
url: "https://unshade.pl/en/services/security-audits"
lang: "en"
summary: "A review of configuration and compliance — NIS2, DORA, ISO 27001 — with a remediation plan."
---

# Security audits

We check whether configurations, processes and code meet the requirements — technically and regulatory. No pile of documents, just a plan of action.

## Scope

- System and service configuration review
- Security code review
- Gap analysis against NIS2 / DORA
- Architecture review and threat modelling
- Vendor security assessment

## What you get

- Risk-rated report
- Compliance map against requirements
- Prioritised remediation plan
- Support during implementation

## Audit versus penetration test

A test answers “can someone break in”. An audit answers “are we protected the way regulation and good practice require” — and where the gaps are. The two complement each other: test findings often feed the audit, and the audit shows what is worth testing.

## Scope

- **Review of current controls** — identifying weak points and recommending improvements.
- **Source code analysis** — assessing application security at different stages of development, finding vulnerabilities and optimising safeguards.
- **Network and system security** — verifying configuration, resilience to attacks and compliance with industry standards.
- **Processes and policies** — procedures, business continuity plans, access and incident management.
- **Vendors** — assessing the security of partners and the supply chain.

## NIS2, DORA, ISO 27001

We map the current state to the directive, regulation or standard, point out the missing controls and order them by risk impact and cost of implementation. Instead of a pile of documents you get a prioritised action plan — and support in carrying it out, including in talks with the external auditor.

## What our clients say

> Working with Unshade guarantees professionalism and the highest standards. The team's flexibility, discretion and commitment were outstanding. I highly recommend Unshade as a reliable partner.
> — Marcin Marczewski, CEO, Resilia

> Unshade is a reliable and professional partner that conducted penetration tests and IT security workshops for us at the highest level. The team's expert knowledge and meticulousness resulted in a real strengthening of our systems' security. We fully recommend their services.
> — Piotr Goździejewski, Head of DevSecOps, e-file

> Unshade are experts you can rely on. Their knowledge, precision and dedication allowed us to ensure the highest level of security for our client's systems. I recommend their services to anyone looking for a solid partner in penetration testing.
> — Michał Mikołajczak, CEO, DataRabbit

## Blog

- [120 minutes that can save your company – a cybersecurity awareness training](https://unshade.pl/en/blog/120-minutes-that-can-save-your-company.md)
- [PBKDF i bcrypt](https://unshade.pl/en/blog/pbkdf-and-bcrypt.md)
- [How to Bypass AMSI? My Experience with PowerShell Bypassing](https://unshade.pl/en/blog/how-to-bypass-amsi.md)
- [Bcrypt Cocktail and Hash Extraction](https://unshade.pl/en/blog/bcrypt-cocktail-and-hash-extraction.md)
- [Sacrificial session](https://unshade.pl/en/blog/sacrificial-session.md)
- [Hash function](https://unshade.pl/en/blog/hash-function.md)
- [Introduction to Password Cracking #3 Rules](https://unshade.pl/en/blog/introduction-to-password-cracking-3-rules.md)
- [Introduction to Password Cracking #1 Intro](https://unshade.pl/en/blog/introduction-to-password-cracking-1-intro.md)
- [Introduction to Password Cracking #2 Wordlists](https://unshade.pl/en/blog/introduction-to-password-cracking-2-wordlists.md)
- [CrackMeIFYouCan 2022 DEFCON Writeup](https://unshade.pl/en/blog/crackmeifyoucan-2022-defcon-writeup.md)

## Request an anonymised report

See what our penetration test report looks like: the structure, findings with PoC, CVSS ratings and recommendations. We send an anonymised version to your work email.