Cybersecurity audit
A focused and affordable first step.
What vulnerabilities your infrastructure has, how your security policies stand, and where to start improving, with a 90-day roadmap.
- Over 15 years of experience
- Microsoft partner since 2010
- Over 200 large organizations as clients
- ISO 27001 certified
- In-house team in Barcelona and Madrid
THE STARTING POINT
Vulnerabilities don't give warning
Most incidents don't exploit sophisticated flaws: they take advantage of doors nobody has checked.
Exposure
Services open to the internet
Published ports and services nobody remembers opening: remote access, management panels, old VPNs.
Patching
Systems past end of life
Operating systems and services without patches or no longer supported by the vendor, with public vulnerabilities.
Configuration
Default weaknesses
Insecure protocols, default credentials and unnecessary services active on servers and network devices.
Organization
Policies on paper, or no paper at all
Access, passwords, backups and suppliers without a defined policy or without checking that it is followed.
Without an audit, the first to measure your exposure may be an attacker.
When does it make sense to audit?
If you identify with any of these scenarios, the audit gives you the foundation to act.
It has never been measured
There is no objective measurement of vulnerabilities or of the maturity of security policies.
Customers or insurers
Customer security questionnaires and cyber-risk policies that ask for technical evidence.
Small or outsourced IT
Nobody has security as their main role or the time to review it systematically.
Incident or intrusion attempt
Find out which other doors are still open before someone else finds them.
Also as a periodic review: yearly or after each significant change in the infrastructure.
Audit first, investment later
Before buying tools: know what is exposed, what is critical and which actions reduce the most risk.
Without an audit
Protecting blindly
- Tools bought without knowing what to protect
- Unpatched systems nobody has inventoried
- Exposed ports nobody remembers opening
- Policies that exist on paper, or don't exist
- Scanner reports nobody prioritizes
Result: more spending and the same risk, unmeasured
With Itequia
An evidence-based plan
- Infrastructure and policies, in a single analysis
- Real vulnerabilities, reviewed by specialists
- Every finding, with its criticality and its fix
- Technical report and executive summary
- Roadmap: immediate, 30 days and 90 days
Result: decisions based on data, not intuition
Two perspectives, one report
Security fails as much because of technology as because of organization: we audit both.
The infrastructure
Technical review
Vulnerability scanning of networks, servers and services, from inside and from the internet.
The policies
Organizational review
Maturity of the security policies, procedures and practices that are actually applied.
The outcome
A single plan
Technical and organizational findings prioritized together, in a 90-day roadmap.
Where we look
Perimeter
ports, services and remote access exposed to the internet
Internal network
open services, weak configurations and insecure protocols
Servers
on-premises or cloud: operating systems, patching and life cycle
Organization
access, passwords, devices, backups, suppliers and continuity
What we analyze
A single fieldwork engagement covers the network, systems and organization, with evidence.
External perimeter
- Exposed ports
- Published web applications
- Remote access and VPN
- Encryption and certificates
Internal network
- Open services
- Weak configurations
- Insecure protocols
- Default credentials
Servers
- Operating systems
- Patching and life cycle
- Installed services
Policies
- Information security
- Access management
- Passwords and devices
- Supplier management
Continuity
- Backups
- Recovery
- Business continuity
- Incident response
Servers in Azure or other clouds? They are audited just like your own, wherever they are.
Our difference
From scanning to real risk
A scanner returns hundreds of alerts: the value lies in knowing which ones really matter.
01
Scanning with method
OWASP ZAP, OpenVAS and other reference tools on networks, servers and applications, in agreed windows.
02
Review by specialists
We rule out false positives and check each finding against the real context of your systems.
03
Prioritized by risk
Technical criticality, exposure and business impact: what to fix today and what can wait.
Open, recognized tools, no agents to install, and data handled under our ISO 27001 certification.
Four steps, from scanning to plan
A focused service: few sessions with your team and minimal IT time. Duration depends on scope.
01
With your lead
Kickoff
Initial meeting, networks and systems in scope, contacts and scanning windows.
02
Checklist and interviews
Information
Initial checklist, existing policies and short interviews with those responsible.
03
Infrastructure and policies
Scanning and analysis
Internal and external scans, policy review and prioritization of findings.
04
Technical team and management
Report and wrap-up
Delivery of the reports and a closing session with the technical team and with management.
What you get: a report to act on
Executive report
The most relevant risks and their potential impact, without jargon.
Vulnerability report
Scan results, technical description and criticality of each finding.
Specific recommendations
How to fix each vulnerability, not just what is wrong.
Policy maturity
Diagnosis of each organizational area, with its gaps.
Missing documents
Necessary policies and procedures, with proposals for improvement or creation.
Essential minimums
The list of what cannot be missing, so you can start there.
Improvement roadmap in three horizons
What to do immediately, in 30 days and in 90 days, prioritized by risk.
The base scope is limited to keep a low entry cost. Manual pentesting, code auditing and remediation of findings are separate services.
How to engage
An entry-level service, at a fixed price
A limited cost to start measuring: the audit doesn't require you to commit to anything else.
01
Initial assessment
One session to confirm the networks, systems, sites and policies in scope.
02
Audit
At a fixed, affordable price, based on the networks and systems in scope.
03
Remediation
As a project: vulnerabilities, hardening and policies, according to the roadmap.
04
Operation
Monthly fee with Itequia Cloud Operations: systems, identity and security.
The report and the roadmap are yours, to execute with whoever you choose. Scans run in agreed windows and data is handled under our ISO 27001 certification.
What you get
Know where you stand
An objective measurement of vulnerabilities and maturity.
Risks in plain sight
Exposed services, unpatched systems and unsupported versions.
Clear priorities
What to fix today, in 30 days and in 90 days.
Evidence for third parties
Reports for customers and insurers.
Complete policies
What is missing and the essential minimums.
Limited entry cost
Fixed, affordable price, agreed before starting.
Where the audit fits
The audit is the starting point: it works on its own or as an entry to the rest of Itequia's services.
Diagnose
NIS2, ENS and ISO 27001 Diagnosis
Applicability, gap per framework and prioritized action plan.
Audit
Cybersecurity audit
Infrastructure vulnerabilities and policy maturity.
Assess applications
Well-Architected Assessment
Code, architecture and platform against the five pillars.
IMPLEMENT AND OPERATE
Itequia Cloud Operations
Microsoft 365, identity, security, Azure and licenses.
Each service is contracted separately. Audit, compliance and operations with the same partner.
Why Itequia is the best choice for your software development needs?
With over 15 years of experience in the digital sector, we offer efficient and personalized software development services. Our agile methodology and management tools guarantee deliveries that adapt to your needs.
As a Microsoft Solutions Partner, we have the competence and experience to use the most advanced technologies.
We have a team of more than 50 highly qualified human professionals consisting of analysts, designers, developers, testers, consultants, and project managers.
Over 15 years of experience
Frequently asked questions
Do you know what you have exposed to the internet?
Tell us what worries you and what your customers or insurers are asking of you.