Selected engagements

Challenge

The company's staff connect to internal systems through an SSL VPN gateway with single sign-on to Microsoft Entra ID. Management wanted an independent answer to a simple question: what can an attacker on the internet achieve against this entry point?

What we did

• ›Scope, test window and rules of engagement signed by both sides before testing; all traffic from a single declared source IP.
• ›Black-box, unauthenticated testing in two phases — from the open internet, then from an allow-listed position.
• ›Reconnaissance and OSINT on the identity provider, enumeration of the VPN portal and its authentication paths, TLS review and controlled password-guessing within agreed limits.
• ›Every finding verified manually and rated with CVSS v3.1.

Outcome

• ›14 findings — none critical, 2 high, 6 medium, 3 low, 3 informational — plus 5 observations.
• ›No valid credentials obtained; account protection and SSO held up under the agreed attack scenarios.
• ›Executive summary for management and a technical report with a concrete fix for every finding.

Challenge

The company fell in scope of NIS2 and wanted to use the obligation to build a proper information security management system aligned with ISO/IEC 27001:2022, rather than a set of documents nobody reads.

What we did

• ›Gap analysis against ISO/IEC 27001:2022 and the NIS2 risk-management measures.
• ›Context, scope, asset inventory, risk assessment and Statement of Applicability.
• ›Policies and procedures written for how the company actually works.
• ›Awareness training for staff and management.

Outcome

• ›A working ISMS with clear owners for each control.
• ›Documented evidence for the NIS2 risk-management and training requirements.
• ›Staff trained, with records ready for audits.

Challenge

An operator of essential services runs a corporate IT network and an industrial OT/SCADA network across several sites, connected through a controlled interface. Its procedure library had to cover ISO/IEC 27001:2022, NIS2, IEC 62443 and national cybersecurity regulation at the same time.

What we did

• ›Review of the existing procedure library against ISO/IEC 27001:2022, NIS2, IEC 62443, NIST/CIS and GDPR.
• ›New and extended work instructions — for example cryptography and cloud services — with OT-specific requirements clearly marked.
• ›Bilingual documents (English and Bulgarian) so both local staff and international partners can use them.

Outcome

• ›One procedure set that maps to several frameworks instead of parallel documentation.
• ›OT requirements visible at a glance for engineers and auditors.

Challenge

The client needed central visibility over its servers and workstations without building an in-house SOC.

What we did

• ›Deployment of a managed, multi-tenant SIEM platform with agents on servers and workstations (several dozen endpoints).
• ›Client-specific dashboards and detection rules tuned to the environment.
• ›Alert triage and escalation to the client's IT team.

Outcome

• ›An external attack against the client's VPN was detected and successfully shut down.
• ›Custom intrusion-detection rules were created from the incident and added to continuous monitoring.
• ›Monitoring also revealed a workstation making hundreds of NTLM authentication attempts against the domain administrator account on a server, recurring roughly every 12 hours — reported to the client for investigation.
• ›Coverage gaps found during tuning (servers missing tenant labels) were identified and a remediation plan agreed with the client.

Challenge

A software and IT services company working for automotive customers needed TISAX, while its wider customer base expected ISO/IEC 27001 for information security and ISO/IEC 20000-1 for IT service management. Running three separate programmes was not an option.

What we did

• ›One integrated management system covering information security (ISO/IEC 27001), IT service management (ISO/IEC 20000-1) and the VDA ISA catalogue for TISAX.
• ›Shared risk assessment, policies and processes, with framework-specific requirements mapped on top.
• ›Preparation for the external assessments.

Outcome

• ›A single set of processes and evidence serving three frameworks.
• ›Less duplicated documentation and one audit calendar instead of three.

Challenge

The company needed a TISAX label to keep working with automotive customers, within a fixed timeline and alongside group-wide security policies.

What we did

• ›Scoping of the assessment and the required protection levels.
• ›Gap analysis against the VDA ISA catalogue and a prioritised action plan.
• ›Policies, procedures and evidence aligned with the group's existing controls.
• ›Preparation for the assessment.

Outcome

• ›Clear, prioritised path to the TISAX assessment.
• ›Local procedures consistent with group-level security requirements.

Challenge

A fast-moving, highly regulated online business needed an information security management system that could keep up with frequent releases, multiple markets and demanding external audits.

What we did

• ›ISMS scope, risk assessment and Statement of Applicability aligned with ISO/IEC 27001:2022.
• ›Policies and procedures designed around agile delivery rather than against it.
• ›Internal audit and preparation for certification audits.

Outcome

• ›An ISMS that fits the pace of the business.
• ›Evidence and audit trail ready for external auditors and regulators.