Question 1

How does a security audit with you work?

Accepted Answer

Four phases: scoping (we define the scope together), analysis (code review + dynamic testing), reporting (every finding with CVSS, reproduction and fix recommendation), and optional remediation (I fix the critical vulnerabilities myself). Typical engagement: 1–2 weeks, 3–5 person-days on the client side.

Question 2

What do your audits cost?

Accepted Answer

Health Check: from €1,500 (3–5 days). Security Audit: from €3,200 (1–2 weeks). Firmware Audit: €5,000–12,000 (1–3 weeks). NIS2 Readiness: €3,000–5,000 (1–2 weeks). All fixed-price with scope locked before contract. No hidden hourly charges.

Question 3

Do you fix the vulnerabilities yourself or only report them?

Accepted Answer

Both — and that's the differentiator. Pure audit report, or direct remediation of the critical findings as a bundle. That removes the typical auditor-vs-developer ping-pong. Audit and implementation from a single hand.

Question 4

What does a security check cost?

Accepted Answer

A quick Health Check starts at €1,500. A full security check ranges from €3,200 to €12,000 depending on scope — as a fixed price we agree before the contract. No nasty surprises on the invoice at the end.

Question 5

How long does it take?

Accepted Answer

A quick Health Check takes 3–5 working days. A full check with everything included usually takes 1–2 weeks, up to 3 weeks for larger systems.

Question 6

What's the difference between an audit and a penetration test?

Accepted Answer

An audit is broader and more systematic — it looks at the program code, the structure, the setup and the processes. A penetration test is more targeted and actively tries to exploit gaps. I offer both, usually together: a check where I also practically exploit the most important gaps to prove them.

Question 7

How do I get the results?

Accepted Answer

As a PDF report with a short summary for management, a rating of every gap, step-by-step instructions to reproduce it, and concrete suggested fixes. On request I walk your team through the results in a 60-minute call so the fixing can start right away.

Question 8

Do you fix the gaps yourselves, or only report them?

Accepted Answer

Both — and that's exactly what sets me apart. Either just the report, or I fix the critical gaps directly as a package. That removes the usual back-and-forth between tester and developer.

Question 9

Do I need a check like this for NIS2?

Accepted Answer

NIS2 doesn't require a specific format, but it does require demonstrably secure development and a solid way of handling weak spots. A security check provides exactly that evidence — with documentation that holds up in a NIS2 review.

Question 10

What is a security check for device software, and how long does it take?

Accepted Answer

I examine the software on a device for weaknesses: the software itself, the start-up process, the updates, the way the device communicates and its connectors. For a simple device with a small control chip (e.g. ESP32, STM32, Nordic) this takes 1 to 3 weeks. For larger, more complex devices with more software, expect 3 to 6 weeks.

Question 11

Do connected devices have to meet the NIS2 rules?

Accepted Answer

NIS2 applies mainly to operators of especially important facilities. If your devices run in such areas (energy, healthcare, manufacturing, water), you fall under the obligations — which include assessing weaknesses in a verifiable way and being prepared for security incidents.

Question 12

What's the difference between checking the server systems and checking the device software?

Accepted Answer

A server check looks at interfaces, cloud settings and the program code on the servers. A device check looks at what runs directly on the device — down to the start-up process, the connectors and the time-critical behaviour. For connected products you usually need both.

Question 13

How do you check whether the remote update path is secure?

Accepted Answer

We check, among other things: Is the start-up program genuine and protected? Does the device itself verify that an update really comes from you? How are the secret keys managed and replaced when needed? Is a rollback to an old, insecure version prevented? Is the transfer encrypted, and what happens if an update is interrupted? Common findings: no authenticity check, keys stored unprotected, no protection against rollbacks.

Question 14

Which device types do you support?

Accepted Answer

The focus is on common control chips: ESP32, STM32 (all Cortex-M series) and Nordic nRF5/nRF52. Also NXP i.MX, TI MSP/Sitara and devices with built-in Linux (Yocto, Buildroot). For unusual platforms we clarify upfront whether the check can be done properly within the available time.

Question 15

How do you deal with pre-set default passwords on existing device fleets?

Accepted Answer

First a stocktaking: which devices carry which access data, and which accounts can be reached from outside? Then step by step: a remote update that forces the passwords to be changed, monitoring of the remaining devices, and the right documentation for the reporting obligations (NIS2/CRA). If a remote update isn't possible, we plan the replacement on site and shield the devices within the network as a stop-gap.

Question 16

Am I actually in scope for NIS2?

Accepted Answer

The three indicators above give you a first orientation. What's authoritative are Annexes I and II of the NIS-2 directive and the size thresholds (medium-sized entity from 50 employees or €10M revenue; essential from 250 / €50M). Suppliers to entities in scope can also fall into scope. A defensible case-by-case assessment should be done together with a lawyer specialised in IT law.

Question 17

What does a NIS2 readiness audit cost at Büngener Software?

Accepted Answer

€3,000 to €5,000 net depending on scope, with the range fixed before the contract is signed. Optional retainer from €800 net per month. No hidden hourly rates, no sub-consultant margins.

Question 18

How does the audit run and how long does it take?

Accepted Answer

Four phases, two weeks of net processing time. On your side, plan for three to five person-days spread across the two weeks — kickoff, provisioning access, follow-ups, sign-off.

Question 19

nis2.faq.items.artifacts.q

Accepted Answer

nis2.faq.items.artifacts.a

Question 20

Is this legal advice?

Accepted Answer

No. This audit is a technical assessment referring to the obligations catalogue of the NIS-2 directive and its German transposition. A legal appraisal of the individual case — applicability, fine risk, or personal liability of management — remains with a lawyer specialised in IT and data protection law. On request, I work with your law firm.

Frequently Asked Questions

General Questions

FAQ — Security Check

FAQ — Embedded Security Audit

Frequently asked questions.

Want to go deeper?