Security compliance audit
Full review of your security practices against a recognised framework (most often ISO 27001, or your internal framework). Compliance report with gaps, and prioritised action plan based on actual risk.
CISO toolkit · One-off engagement
Cybersecurity audit and penetration testing in Luxembourg: an honest snapshot.
Want to know where you really stand? We assess the security level of your applications, your cloud productivity (M365 or Google Workspace) and your compliance posture, with an action-oriented format. No 200-page unreadable report. You get the vulnerabilities ranked by severity, the estimated remediation effort, and a re-check after your fixes.
What we offer
M365 / Google Workspace configuration review
Your cloud office suite holds your accounts, email and shared files. We audit your M365 or Google Workspace settings point by point: full MFA, external sharing, forwarding rules, third-party apps, logging, DLP, anti-phishing, backups, dormant accounts, admin rights. You get a security score, the precise list of gaps and the exact steps to harden, ranked by impact.
Penetration test on an application
We simulate an attack on your website, customer portal or mobile app. You get the list of vulnerabilities found, how an attacker could exploit them, and how to fix them. A re-check is included once fixes are in place.
Rapid incident response
Suspecting an ongoing intrusion? Call us without a prior mandate. We quickly qualify the situation, help contain, document for authorities if needed, and deliver an actionable report.
Order online
Phishing simulation, turnkey
Test and train your staff (up to 200) with a 100% simulated campaign. €850 excl. VAT per campaign, supporting the awareness and training required by NIS 2 (Article 21) and DORA (Article 13), order online in 2 minutes.
Order a simulation →Audits and penetration tests: frequently asked questions
What is the difference between a cybersecurity audit and a penetration test?
An audit measures your practices against a framework, ISO 27001 or the risk-management measures in Article 21 of the NIS 2 Directive: organisation, procedures, configurations. It tells you where you stand. A penetration test simulates an attack on a defined scope (website, customer portal, mobile app) to find the flaws that can really be exploited. It tells you how an attacker would get in. The two work together: the audit sets the roadmap, the penetration test checks it in the field.
What does a cybersecurity audit cover?
Security policies and their governance, access management and multi-factor authentication, backups and business continuity, incident handling, supplier security, and the settings of your cloud office suite (Microsoft 365 or Google Workspace: external sharing, forwarding rules, third-party apps, logging, dormant accounts, admin rights). The most common framework is ISO 27001: our ISO 27001 in Luxembourg page walks through the path to certification.
What is in the report you deliver?
Vulnerabilities and gaps ranked by severity; for each one, how an attacker could exploit it, the recommended fix and the estimated effort; then an action plan prioritised by actual risk. A short, action-oriented document, not a 200-page report. A re-test is included once your fixes are in place.
Do NIS 2 and DORA require audits or tests?
NIS 2 requires policies and procedures to assess the effectiveness of cybersecurity risk-management measures (Article 21(2)(f)). DORA requires financial entities other than microenterprises to run a digital operational resilience testing programme (Article 24): at least once a year, appropriate tests on all ICT systems and applications supporting critical or important functions. The possible tests, from vulnerability assessments to penetration testing, are listed in Article 25. Entities identified by their authority must also carry out threat-led penetration testing at least every three years (TLPT, Article 26), by testers who meet the requirements of Article 27.
How does a penetration test work?
We first agree on the scope and the test conditions, then simulate the attack. You receive the list of flaws found, how an attacker could exploit them and how to fix them. A re-test is included once fixes are in place. For a TLPT under DORA, scoping is bespoke: contact us.
How much does a penetration test cost?
It depends on the scope: number of applications and addresses to test, tests with or without a user account, expected depth. You configure the quote online, item by item, and receive a proposal within 24 business hours. Our other services in Luxembourg (outsourced CISO, dark web monitoring, counter-espionage) are presented on the cybersecurity in Luxembourg page.
Related topics
Get your tailored quote
Configure the modules you care about, receive a priced proposal within one business day.
Build my quote →