Services in detail
Here you can see exactly what I do for each service, how I do it and what you receive at the end. No jargon – and no surprises.
For all security tests
- I only test with written authorisation and only the systems we have agreed on together.
- No attacks that disrupt your business (no DoS, no load tests).
- I access as little data as necessary to prove a problem. I don't download databases.
- If I find something critical, I call you the same day – without waiting for the report.
- I store your data encrypted and delete it no later than 90 days after the report.
- Every report starts with a summary for management, without technical terms. Afterwards I explain everything in a personal meeting.
Managed IT subscription
Fixed monthly fee
I take care of your IT on an ongoing basis so you can take care of your business. You have one fixed contact person: me.
How I work
- Free initial meeting, ideally at your office.
- Inventory: devices, accounts, licences, backups and security. You receive a short overview.
- A clear offer with a fixed monthly fee per workstation.
- I set up remote access and document your IT.
- Ongoing support: you contact me by e-mail, phone or WhatsApp, and I reply within 24 hours on working days.
What you receive
- Basic: remote support for your team, Microsoft 365 management, checking updates and backups, staff joining and leaving (accounts, devices, access).
- Plus: everything in Basic, plus one on-site visit per month and a security check every quarter.
- Pro: everything in Plus, plus one phishing training per year and a security report for management.
- Up-to-date documentation of your IT.
What I don't do
- I don't change anything important without your approval.
- No hidden costs: extra work only by agreement.
What I need from you
- One contact person in your company.
- Access to the systems I should look after.
External quick scan
½–1 day
I look at your company from the outside – the way an attacker on the internet would. Without login details and without putting load on your systems.
How I work
- I look for publicly visible information: subdomains, technology in use, data in search engines, leaked credentials of your domain.
- I check what really belongs to you. If something is unclear, I ask.
- I check the open services on your servers (with low load).
- I check the configuration: HTTPS certificates, security headers and e-mail protection (SPF, DKIM, DMARC).
- I look for outdated software and exposed files (e.g. backups).
What you receive
- A short report (3–6 pages) with the main risks and concrete measures.
- My recommendation on whether a full test is worthwhile.
What I don't do
- I don't exploit vulnerabilities.
- I don't test logins.
- No aggressive scans.
What I need from you
- Your domain(s).
- Confirmation of which servers and services belong to you.
Hardening review
1–2 days
I check your servers, your Microsoft 365 or your cloud for insecure settings. I only have read access – I don't attack or change anything.
How I work
- We agree on which systems I check.
- I collect the settings with proven audit tools and compare them with recognised recommendations (CIS Benchmarks).
- I check the results by hand so that no false alarms end up in the report.
- Microsoft 365: e.g. two-factor login for everyone, number of administrators, forwarding rules, external sharing.
- Servers and Active Directory: e.g. password rules, administrator accounts, outdated protocols, updates.
What you receive
- A list of measures, sorted by priority.
- For each measure: instructions for implementation and the risk if you do nothing.
What I don't do
- I don't change settings on my own. Implementation can be ordered separately.
What I need from you
- An account with read access (or an accompanied session).
- The list of systems and who manages them.
Web application pentest
2–3 days
I test your web application by hand, the way an attacker would – following the recognised OWASP standard. Automatic scanners alone are not enough.
How I work
- I go through the whole application and create an overview: functions, user roles and interfaces.
- I check the login: password rules, lockout after failed attempts, password reset, two-factor login.
- I check the sessions: cookies, logout, expiry.
- The most important part: I check whether one user can see another user's data or get admin rights.
- I test the inputs for typical attacks such as XSS and SQL injection, including file uploads.
- I check the business logic, e.g. whether steps can be skipped or prices changed.
- I confirm every finding a second time and delete all test data at the end.
What you receive
- A full report: every finding with proof, severity (CVSS) and a concrete fix.
- An action plan: immediately, within 30 days, within 90 days.
- A final meeting in which I explain everything to you.
- On request, a retest at a reduced price.
What I don't do
- No tests that take your application down (no DoS).
- No attacks on other customers of your hosting provider.
- No phishing without an explicit order.
- No tests in production at peak times without agreement.
What I need from you
- The address(es) of the application.
- Two test accounts per role (e.g. 2 normal users and 1 admin).
- If possible, a test environment (staging).
Retest
½ day
After your fixes, I check whether the vulnerabilities are really fixed.
How I work
- You tell me which points you fixed and when.
- I repeat exactly the test from the report – plus one or two variants, so that not only the symptom is fixed.
- For each point I record: fixed, partly fixed or not fixed.
What you receive
- An updated report with a status table – as proof for audits, insurers or your customers.
What I don't do
- I don't look for new vulnerabilities – that would be a new test.
What I need from you
- The original report and the list of your fixes.
Data recovery & secure deletion
depending on the device
I recover accidentally deleted data and wipe old storage devices so that nothing can be recovered.
How I work
- Data recovery: I receive the device with a handover record (serial number, photo, your signature).
- I connect it read-only and first make a full copy. I no longer work on the original.
- On the copy, I restore partitions and files.
- Secure deletion: I wipe according to the NIST SP 800-88 standard, with the right method for HDD, SSD, USB stick or SD card.
- Afterwards I check that nothing is readable any more.
What you receive
- Data recovery: your data on a new device and a list of what could be recovered.
- If nothing can be recovered, you only pay for the diagnosis.
- Secure deletion: a deletion certificate per device (model, serial number, method, date, signature).
What I don't do
- I don't open damaged devices. For physical damage (clicking, drop, water) I recommend a specialised lab.
- I don't look at the content of your files – I only check whether they open.
What I need from you
- The device and a description of which data are important.
Secure websites & maintenance
Fixed price
I build fast, simple websites that are secure from the start – like this one.
How I work
- We discuss the goal, pages, texts, images and languages.
- I make a design proposal (one round of corrections included).
- I build a static website: no database and no unnecessary scripts, so very little attack surface.
- I create the legal notice and privacy policy under Swiss law. No tracking cookies by default.
- I put the website online with HTTPS and strict security settings, also for the e-mails of your domain.
- I check the website with independent tests and show you the results.
What you receive
- A finished website and a report with the test results.
- All access in your name – the domain belongs to you.
- On request, maintenance: monthly check and small changes.
What I don't do
- No online shops and no customer areas (I make a separate offer for those).
What I need from you
- Your texts and images (or we create them together).