Cyber Security Assessment Services

We check the effectiveness of:

• Technology controls, such as secure configurations of hardware and software, preventive and detective tools.
• Process controls, e.g., security monitoring, incident response, and disaster recovery.
• People controls: cyber resilience of the staff.

We detect vulnerabilities by scanning:

• Network, e.g., servers, workstations, network interface devices.
• Applications: web, mobile, and desktop apps.
• Databases.

We simulate real-world attacks to find vulnerabilities and attempt to penetrate the system through:

• Internal networks.
• Publicly accessible systems, such as customer-facing apps, IoT systems, email services.
• Remote access infrastructure.

To check employees’ resilience to social engineering attacks, we simulate:

• Phishing scam – malicious emails sent to multiple employees.
• Spear phishing – emails targeting specific employees (e.g., holding access to restricted information).
• Whaling – emails targeting C-level executives.
• Vishing – manipulative phone calls.
• Smishing – manipulative mobile text messages.

To evaluate cyber risks, we:

• Identify vulnerabilities in policies and procedures, IT environment, human behavior.
• Define the threats posed by the discovered vulnerabilities: data theft, malware spread, account takeover, etc.
• Assess the likelihood and severity of potential consequences in case of vulnerability exploitation.

To help companies identify gaps and strengthen their compliance, we:

• Assess the existing security controls against the relevant standards, e.g., HIPAA, PCI DSS/PCI SSF, GDPR, NYDFS.
• Evaluate the employees' awareness of applicable standards and regulations.
• Provide remediation guidance to manage compliance risks.
• Help close compliance gaps, e.g., design and implement a network architecture compliant with a required standard, migrate to a complaint cloud, set up a data encryption mechanism.

• Security audit report.
• Penetration testing and vulnerability assessment reports describing and prioritizing the detected vulnerabilities.
• Social engineering campaign report.
• Risk assessment report.
• Compliance gap analysis report.
• Network configuration diagrams.
• Report on the existing gaps in the IT policies and procedures.
• Report on the staff’s cyber awareness.
• Report on the state of IT security training materials.

• Remediation guidelines: an IT risk management plan, a list of corrective measures for all the detected vulnerabilities.
• Recommendations on improving policies and procedures: e.g., on how to improve the security training process and materials.
• Remediation help: e.g., secure network architecture design, secure software architecture design, a list of software security features.

With hands-on experience in 30+ industries, we assign specialists with the relevant domain expertise to each specific project to ensure a deep understanding of the business specifics.

We combine different assessment techniques and tools to detect maximum vulnerabilities at all levels of your cyber defense.

We classify vulnerabilities based on their criticality to help you prioritize remediation activities and wisely allocate resources.

We help you pinpoint and strengthen vulnerable areas in your cyberdefense before hackers can take advantage of them.

We leverage our experience with major security standards (PCI DSS, PCI SSF, HIPAA, ISO 27001, GDPR) to help you detect and remediate gaps hindering your compliance.

To give an all-around view of network protection, we:

• Create a detailed network map.
• Evaluate network architecture.
• Analyze configurations of network devices.
• Assess the efficiency of firewalls, IDS/IPS, DLP, SIEM, and other network security tools.
• Review the network security policies and procedures: e.g., access control, incident response policies.
• Analyze network traffic, and more.

Within a comprehensive mobile or web application security assessment, we check:

• Authentication and authorization.
• Input and output validation.
• Error handling and logging.
• Data protection.
• Third-party components.
• Configuration setting.
• Secure development practices.
• Secure deployment practices, and more.

We define the security responsibilities of the cloud customer, and check how well the necessary measures are implemented, for example:

• Identity access management: user provisioning, role-based access control, MFA, service account management.
• Data protection and adherence to data privacy standards: data encryption, isolation, and recovery practices.
• Secure configuration management.
• Monitoring, threat detection and incident response, and more.

To check if a database meets security best practices and compliance requirements, we evaluate:

• Data encryption.
• Database patch management.
• Database activity monitoring.
• Database backup and recovery.
• Change management.
• Security awareness of database administrators and users.