Talk to a specialist
Part of Assess

Cybersecurity audit and risk assessment

We measure your organization's real exposure against a recognized framework and turn it into a plan: what to fix first, why, and how much effort it takes.

Request an assessmentFrequently asked questions

What is included

  • Identification of critical assets, sensitive data and third-party dependencies
  • Review of technical, process and governance controls against ISO/IEC 27001, NIST CSF or CIS Controls
  • Assessment of network, identity, email, cloud and endpoint configuration
  • Risk analysis with likelihood and impact agreed with your business
  • Review of policies, procedures and evidence of operation
  • Gaps against the regulatory requirements that apply to you

This is for you if

  • You need to know where to start a security program
  • A customer, regulator or auditor asks for evidence of your controls
  • Your environment changed (cloud, merger, new vendor) and you do not know what new risk you took on

How we do it

  1. Scope and assets

    We agree on what is assessed, what is critical to your business and which framework to use.

  2. Controls review

    We compare what is documented with what actually operates, with technical evidence for every finding.

  3. Risk analysis

    Each gap is rated by likelihood and impact, not only by technical severity.

  4. Plan and presentation

    We deliver a prioritized remediation plan and present it to leadership and the technical team.

What you receive

  • Executive report for leadership
  • Technical report with findings and evidence
  • Risk matrix
  • Remediation plan prioritized by risk
  • Results presentation session

Frameworks and methodologies

  • ISO/IEC 27001
  • ISO/IEC 27005
  • NIST CSF
  • CIS Controls
  • COBIT 2019

Two tools to get started

Illustrative simulations, in your browser and with no data: which assessment fits what you use and how likelihood and impact combine.

Illustrative simulation

Exposure simulator

Tick what your organization uses and see which assessment fits.

Open the full simulator
Illustrative simulation

5×5 risk matrix

Combine likelihood and impact across five scenarios and see whether it usually pays to accept, mitigate, transfer or avoid.

Open the matrix

Related experience

We group experiences without identifying clients or publishing sensitive data. Results correspond to the documented scope of each engagement.

See all experiences
  • Consolidated experience 02

    Multi-sectorPentesting

    External exposure, web applications and digital risks

    Problem
    Applications, public services and information exposure called for a technical review to identify risks and guide fixes.
    Results
    • Findings prioritized by application and asset.
    • Information and component exposures identified.
    • Recommendations specific to the risk observed.

    Identities withheld

  • Consolidated experience 05

    Multi-sectorAudit

    Vulnerabilities, follow-up and verification of fixes

    Problem
    Organizations needed to prioritize technical exposures and to check which risks persisted after corrective measures were applied.
    Results
    • Obsolescence and risky configurations prioritized.
    • Fixes checked in documented revalidations.
    • Residual and pending risks made visible for follow-up.

    Identities withheld

  • Consolidated experience 06

    Multi-sectorAudit

    Controls audit and security governance

    Problem
    Organizations needed to review controls, responsibilities and operating conditions to inform their security decisions.
    Results
    • Security policies and responsibilities documented.
    • Controls and observed conditions recorded.
    • Recommendations for reviewing and improving controls.

    Identities withheld

Consolidated experience 02

PentestingMulti-sector

External exposure, web applications and digital risks

Sectors served

  • Banking
  • Government
  • Aviation
  • Legal
  • Private sector

Services offered / delivered

  • External and web/API penetration testing
  • Black-box and gray-box assessments
  • OSINT and digital exposure intelligence

Context

This experience consolidates work on public-facing surfaces and applications, together with digital exposure investigations. Each engagement kept its own scope and methodology.

Documented interventions

  • Assessment of authentication, sessions, configuration and controls in web/API applications.
  • Review of published services, components, certificates and administrative surfaces.
  • In intelligence work, identification of public assets and of exposed identities or information.

Documented results

  • Findings and recommendations were delivered separately for each application, service or exposure investigated.
  • Some surfaces produced no findings in their tests. That result was not extended to other assets or to the organization as a whole.

Scope of the result

Exposure in external sources does not prove valid credentials, active sessions or an intrusion. A client's reply about fixes is not the same as an independent retest.

Methodology

Controlled testing of applications and services; research in external sources for the intelligence work.

Identities withheld

Consolidated experience 05

AuditMulti-sector

Vulnerabilities, follow-up and verification of fixes

Sectors served

  • Banking
  • Government
  • Legal
  • Private sector

Services offered / delivered

  • Vulnerability analysis and management
  • Assessment of critical infrastructure and SWIFT environments, depending on scope
  • Periodic assessments and technical prioritization
  • Retest and revalidation of remediation

Context

This group brings together assessment cycles, technical matrices and revalidations. Differences in scope and date were preserved in each engagement.

Documented interventions

  • Identification of unsupported software, pending patches and insecure configurations.
  • Organization of findings and recommendations by severity and impact.
  • Comparison of initial and later results where a documented revalidation exists.

Documented results

  • In some revalidations, critical and high risks within the scope assessed were no longer recorded; in others, relevant exposures remained.
  • The documentation made it possible to distinguish verified fixes, residual risks and findings that needed follow-up.

Scope of the result

Not every assessment had a retest. Differences between scans can depend on scope, date or plugins. We do not promise that risk is eliminated entirely.

Methodology

Vulnerability analysis, technical review and comparison of evidence between cycles.

Identities withheld

Consolidated experience 06

AuditMulti-sector

Controls audit and security governance

Sectors served

  • Government
  • Aviation
  • Banking
  • Private sector

Services offered / delivered

  • Diagnosis of security governance and controls
  • Drafting of policies and guidelines
  • Inspection of physical and environmental controls

Context

This experience consolidates controls reviews, document drafting and physical inspections. These were separate engagements that fed into security governance.

Documented interventions

  • Review of controls and responsibilities through interviews, documentation and checklists.
  • Drafting of access, secure development, network, password and acceptable use policies in the engagements that included that service.
  • Inspection of physical, environmental and operational conditions at the facilities assessed.

Documented results

  • Guidelines and documents on responsibilities and operation were delivered in the document-based consulting projects.
  • The assessments and inspections recorded responses and observed conditions, with recommendations bound by the scope of each report.

Scope of the result

We do not claim ISO certification, full compliance or operational adoption of every policy. An inspection describes conditions observed, not permanent compliance.

Methodology

Document review, interviews, checklists and on-site inspection, depending on the engagement.

Identities withheld

Frequently asked questions

What is the difference between an audit and a penetration test?

An audit reviews controls, processes and configuration against a reference framework. A penetration test tries to exploit technical weaknesses to validate which ones can really be reached. They complement each other, and one often defines the scope of the other.

Which frameworks do you work with?

ISO/IEC 27001, NIST CSF, CIS Controls and COBIT 2019, among others. We choose the framework according to your industry, your customers and your regulatory obligations.

What do I receive at the end of the audit?

An executive report, a technical report with evidence, a risk matrix and a prioritized remediation plan, plus a session to present the results.

Related services

Start with a risk assessment

Tell us what you need assessed and how urgent it is. A SoluProTec specialist reviews your request and contacts you through the channel you provide.

Request an assessment