Your cybersecurity partner for risk and resilience

No. It is the normal starting point, and a confidently described problem is often the wrong one anyway.

The first conversation is short and has three questions in it: what could you not be without for a day, what is already in place, and what is forcing the timing — a customer, an auditor, an insurer, or something that has already happened. That is usually enough to tell you whether you need an assessment, a person, or a phone number to call at two in the morning.

If you would rather arrive with something in hand, our self-assessment is twelve questions across eight areas, takes about five minutes, and gives you a ranked report to argue with.

Nobody in particular, which is the point. Most attacks are untargeted and automated: they find an exposed service or a reused password, not a company worth choosing.

The published measurements are unkind on this. Independent 2025 research across small and mid-sized firms found around four in five sitting in the lowest two resilience bands, most with no automated backup and very few carrying cyber insurance.

So the question is not whether you are worth attacking. It is whether you could absorb it — and companies your size usually have less margin for a bad fortnight than the large ones that make the news.

By turning it into something measurable, which is a fair thing to ask of any claim about controls.

A structured assessment against a recognised framework answers it in weeks: what exists, what is documented, what is actually operating, and what each gap would cost to close. It combines questionnaires with your own people, an external scan of what the internet can see of you, and a review of identity, endpoint and cloud configuration.

What comes back is a scored picture with the gaps ranked. Your IT manager then has a list to disagree with, item by item, rather than a question to defend — which is a much better conversation for both of you, and he is quite often right about most of it.

This is the most common reason companies call us, and it is a documentation problem before it is a security problem.

We map the questionnaire to a framework, find what you already have — which is usually more than you think — write the policies and records that are genuinely missing, and hand you the evidence pack.

The useful part is that it is reusable. Enterprise buyers and insurers ask for the same things repeatedly, so the second questionnaire takes a fraction of the time, and the third is mostly retrieval. The work you do for one customer is the work you do for the next twenty.

Because a tool changes nothing on its own. Somebody has to own it, tune it to your environment, and act on what it produces — and if nobody was given that job, the product was never going to work, whatever it cost.

We start with your risk, your regulator and your board rather than a product catalogue. Technology is chosen to serve the roadmap, not the other way round.

Where we do bring technology in, it arrives as a service with named owners and dates against each task, and a monthly report showing what moved. If nothing moved, that is visible too — which is the part most product purchases never had.

Do not wipe or rebuild anything yet. How much of the answer you ever get depends on what survives the first hour.

Isolate the affected machines from the network but leave them powered on. Force a password reset on privileged accounts. Start writing down times and actions as you take them — that log becomes the backbone of everything afterwards, including any insurance or regulatory conversation.

Then call someone. We hold digital forensics and incident response retainers with a 24/7 partner SOC, and an engagement under an existing retainer starts considerably faster than a cold one. If you are not a client, call anyway and we will tell you honestly whether we are the fastest route or whether someone else is.

Three shapes, and all of them are quoted as a fixed scope for a fixed fee before you commit.

A one-off assessment: a named scope, a report, a prioritised plan. This is how most engagements start and it obliges you to nothing afterwards.

A continuing advisory or security-leadership engagement: a monthly fee, usually on a twelve-month term, because posture work that stops after a quarter does not hold.

A project: deploying and tuning a platform, or a piece of technical work, priced as a project and finished when it goes live.

For scale, a full-time security director costs most of a quarter of a million euros a year across salary and overheads, which is precisely why the part-time model exists.

Somebody has to, and in a lot of firms the honest answer is currently nobody — the same 2025 research found around two thirds with no designated owner for network security.

The answer is rarely to hire a chief information security officer. It is to put the accountability somewhere real inside your organisation — usually an existing manager who can make decisions — and buy the expertise part-time alongside it. A virtual CISO supplies the strategy, the risk decisions and the board reporting without a full-time executive on the payroll.

In Hungary there is a further wrinkle: the Cybersecurity Act requires a named, formally qualified security officer, and that role can be filled and registered externally. Your accountability stays internal; the qualification does not have to.