IT security consulting that shows where you stand
Security becomes manageable the moment you can see it clearly. We review your technical and organizational measures, find the weak points and support you with the security requirements of data protection law. If the worst happens, an incident plan keeps you able to act. Every measure is written so that management can follow it too.
- A free 30-minute first call, no strings attached
Audit, penetration test and data protection measures compared
Three questions, three kinds of result. Together they give the full picture, though not every audit needs a penetration test.
Security audit
Broad view of systems, processes and architecture: configuration, processes, architecture and technical and organizational measures. Result: a prioritized action plan. Limit: no practical attack test.
Penetration test
Targeted technical attack test of practically exploitable weaknesses and the attack surface. Result: findings with technical proof. Limit: only systems explicitly released within the agreed scope.
Data protection and technical measures
Technical and organizational measures of the processing against the requirements of Art. 32 GDPR: confidentiality, integrity, availability, recoverability. Result: documented gaps and measures. Limit: no legal advice and no full GDPR review.
What IT security consulting covers
Order a single service or a complete IT security concept. Each one ends with a written result you can confidently present.
Security audit
Area by area, from identities and endpoints to network, backup, Microsoft 365 and administrator rights, your environment gets a thorough look. The audit report rates every finding by its actual risk, so the most urgent work stands out.
Penetration test
A controlled attack on released systems, within a scope agreed together, shows which weaknesses could really be exploited. Each one comes with proof, a risk rating, reproduction steps and concrete recommendations for remediation.
Data protection and technical measures
Your technical and organizational measures for processing personal data are reviewed, in particular with regard to Art. 32 GDPR. Every gap found is documented together with the measure that closes it.
Zero trust access model
Access built on zero trust principles: strong identities, MFA, role-based permissions, conditional access and the lowest possible default rights. Everyone gets exactly what their role requires.
Awareness and phishing simulation
A realistic phishing simulation shows how your team responds. Target group, data protection and internal involvement are agreed beforehand. The evaluation shows how many employees reacted. The training that follows starts right there.
Incident response
When every minute counts, roles are already settled. The incident plan sets out technical and organizational responsibilities, escalation paths and how data protection officers, legal counsel and, where applicable, authorities are involved.
Penetration testing with clear rules
Defined scope
Systems, time windows and test types agreed together.
Rules of engagement
Binding rules on what may be tested and what may not.
Only released systems
We test only what you have explicitly released.
Severity and proof
Every finding is rated and documented so it can be traced technically.
Remediation
Concrete recommendations and reproduction steps for your team.
Optional retest
On request we test again after remediation.
What you can put on the table
Each engagement leaves you with documents made for the people who ask the hard questions: management, your data protection officer or an auditor. Who implements them is entirely your choice.
- Written audit report with findings and a risk-based rating
- Prioritized action plan
- For penetration tests: findings with severity, technical proof and reproduction steps
- Documented gaps against the technical and organizational measures
- Incident response plan with responsibilities and escalation paths
How a security engagement runs
Each step ends with an interim result, so progress is never a black box.
Inventory
We record systems, identities, devices and existing measures, then agree the scope with you.
Analysis and test
Configuration and processes are reviewed in depth. Where agreed, a controlled penetration test follows.
Action plan
The findings arrive rated by risk, in a prioritized plan for remediation. You know what to tackle first.
Delivery and operations
Implementation is yours to assign: Visgenix, your internal IT or another provider. If you choose us, we take over delivery.
What drives effort and duration
Your quote states the frame in writing. These four factors determine it.
Scope
Which systems, sites and cloud services are tested, and whether a penetration test is included.
Size of the environment
Number of devices, servers, user accounts and Microsoft 365 tenants.
Depth of the review
A first security assessment, a full audit, or an audit with penetration test and retest.
Access and cooperation
How quickly access is released and contacts are named on your side.
Frequently asked questions about IT security consulting
Related consulting
Security findings often lead straight to questions of infrastructure and delivery.
- LeistungInfrastructure and networksSegmentation, backup and recovery, planned so an incident reaches as little as possible.
- LeistungProject deliveryYour action plan, implemented with milestones and acceptance.
- LeistungManaged IT (German)Once the audit is done, Visgenix can take over day-to-day operations.
Close your security gaps in the right order
We review technical weaknesses and data protection measures and turn the findings into a plan with clear priorities. It all starts with a non-binding call.