Cloud settings and access rights
For Microsoft 365 and Azure, we look at identity, admin rights, application permissions, data sharing and logging, among other things. The exact checks depend on the services you use and the access available.
Assess
Security audits
A security audit tests how well your environment is secured. Depending on your question, this ranges from a targeted configuration audit to a pentest. An audit can be carried out on its own or as a follow-up to the Cyberwise Baseline.
- Who it is for
- Organisations with a concrete technical question, for example from a customer or insurer, or as a follow-up to the Cyberwise Baseline.
- What you get
- A report with findings, risk assessment and concrete recommendations. We report critical findings immediately.
- What we need from you
- A scope and authorisation agreed in writing, access to the agreed environment and an IT contact person.
- Price
- On request, depending on the type of audit and the scope.
When
On its own or as a follow-up to the Cyberwise Baseline
We tailor the audit to your question and your environment.
- As a follow-up to the Cyberwise Baseline, when the roadmap calls for a deeper technical test.
- On its own, when you have a concrete question, for example from a customer or your insurer.
- We don’t perform a pentest by default. Together we decide whether and when it makes sense.
The difference
A scan, audit or pentest?
A vulnerability scan looks for known weaknesses. A configuration audit assesses settings and access rights. A pentest goes further: within the agreed rules of engagement, we test whether weaknesses can actually be exploited.
The right choice depends on your question, your risks and your environment. The report sets out what we examined, any limitations and which actions should come first.
Options
Types of security audits
Microsoft 365 and AzureAudit of the security settings of your cloud environment.
Network auditAn internal and external scan of your network for vulnerabilities and weak configurations.
PentestWe test your systems the way an attacker would, within an agreed scope and with your written permission.
How we work
How an audit works
- 1ScopeGoal, scope, timing and rules of engagement, agreed in writing.
- 2TestingControlled testing within the agreed scope.
- 3ReportFindings with a risk rating and concrete recommendations. We report critical findings straight away.
- 4Follow-upYour IT partner or IT team fixes the issues. A retest confirms whether the findings have been resolved.
In concrete terms
What we examine and deliver
Internal and external exposure
We examine the agreed network ranges for exposed services, known vulnerabilities and weak configurations. Where agreed, we also look at patching, endpoint protection, segmentation and evidence that you can recover.
A report your IT team can act on
Automated results are reviewed manually and put into context. The report covers risk, rationale, recommendation and limitations; an agreed retest checks the improvements.
For a scan or pentest, we agree targets, test permissions, time windows and emergency contacts in advance. Your IT team provides the agreed access and picks up the technical improvements.
Which technical test do you need?
Tell us what you want tested. We’ll discuss whether a scan, configuration audit or pentest best fits your question and environment.