Frequently Asked Questions

Four phases: scoping (we define the scope together), analysis (code review + dynamic testing), reporting (every finding with CVSS, reproduction and fix recommendation), and optional remediation (I fix the critical vulnerabilities myself). Typical engagement: 1–2 weeks, 3–5 person-days on the client side.

Health Check: from €1,500 (3–5 days). Security Audit: from €2,900 (1–2 weeks). Firmware Audit: €5,000–12,000 (1–3 weeks). NIS2 Readiness: €3,000–5,000 (1–2 weeks). On top of that, a monthly security health check from €990 net. All fixed-price with scope locked before contract. Above the single audit sits the Total Security Care package: six months of continuous coverage for €28,000 net, including remediation and a response time of under one hour. No hidden hourly charges.

Both, and that's the differentiator. Pure audit report, or direct remediation of the critical findings as a bundle. That removes the typical auditor-vs-developer ping-pong. Audit and implementation from a single hand.

A quick Health Check starts at €1,500. A full security check ranges from €2,900 to €7,500 depending on scope, as a fixed price we agree before the contract. If you want six months of continuous coverage instead of a one-off check, the Total Security Care package runs €28,000 net, fixed price, including remediation and a response time of under one hour. No nasty surprises on the invoice at the end.

A quick Health Check takes 3–5 working days. A full check with everything included usually takes 1–2 weeks, up to 3 weeks for larger systems.

An audit is broader and more systematic, it looks at the program code, the structure, the setup and the processes. A penetration test is more targeted and actively tries to exploit gaps. I offer both, usually together: a check where I also practically exploit the most important gaps to prove them.

As a PDF report with a short summary for management, a rating of every gap, step-by-step instructions to reproduce it, and concrete suggested fixes. On request I walk your team through the results in a 60-minute call so the fixing can start right away.

Both, and that's exactly what sets me apart. Either just the report, or I fix the critical gaps directly as a package. That removes the usual back-and-forth between tester and developer.

NIS2 doesn't require a specific format, but it does require demonstrably secure development and a solid way of handling weak spots. A security check provides exactly that evidence, with documentation that holds up in a NIS2 review.

I examine the software on a device for weaknesses: the software itself, the start-up process, the updates, the way the device communicates and its connectors. For a simple device with a small control chip (e.g. ESP32, STM32, Nordic) this takes 1 to 3 weeks. For larger, more complex devices with more software, expect 3 to 6 weeks.

NIS2 applies mainly to operators of especially important facilities. If your devices run in such areas (energy, healthcare, manufacturing, water), you fall under the obligations, which include assessing weaknesses in a verifiable way and being prepared for security incidents.

A server check looks at interfaces, cloud settings and the program code on the servers. A device check looks at what runs directly on the device, down to the start-up process, the connectors and the time-critical behaviour. For connected products you usually need both.

We check, among other things: Is the start-up program genuine and protected? Does the device itself verify that an update really comes from you? How are the secret keys managed and replaced when needed? Is a rollback to an old, insecure version prevented? Is the transfer encrypted, and what happens if an update is interrupted? Common findings: no authenticity check, keys stored unprotected, no protection against rollbacks.

The focus is on common control chips: ESP32, STM32 (all Cortex-M series) and Nordic nRF5/nRF52. Also NXP i.MX, TI MSP/Sitara and devices with built-in Linux (Yocto, Buildroot). For unusual platforms we clarify upfront whether the check can be done properly within the available time.

First a stocktaking: which devices carry which access data, and which accounts can be reached from outside? Then step by step: a remote update that forces the passwords to be changed, monitoring of the remaining devices, and the right documentation for the reporting obligations (NIS2/CRA). If a remote update isn't possible, we plan the replacement on site and shield the devices within the network as a stop-gap.

The three indicators above give you a first orientation. What's authoritative are Annexes I and II of the NIS-2 directive and the size thresholds (medium-sized entity from 50 employees or €10M revenue; essential from 250 / €50M). Suppliers to entities in scope can also fall into scope. A defensible case-by-case assessment should be done together with a lawyer specialised in IT law.

€3,000 to €5,000 net depending on scope, with the range fixed before the contract is signed. Optional retainer from €990 net per month. If you want to be covered continuously rather than audited once, the Total Security Care package runs six months of coverage for €28,000 net, fixed price, including remediation and a response time of under one hour. No hidden hourly rates, no sub-consultant margins.

Four phases, two weeks of net processing time. On your side, plan for three to five person-days spread across the two weeks, kickoff, provisioning access, follow-ups, sign-off.

nis2.faq.items.artifacts.a

No. This audit is a technical assessment referring to the obligations catalogue of the NIS-2 directive and its German transposition. A legal appraisal of the individual case, applicability, fine risk, or personal liability of management, remains with a lawyer specialised in IT and data protection law. On request, I work with your law firm.