VAPT · Microsoft 365 review · firewall audit
Security assessments and VAPT: find the weak points before someone else does.
We run assessments and coordinate specialist testing where needed. You get a short report that lists what is exposed, in order of risk, and a plan to fix it, carried out by the same team if you want. Most findings are ordinary: an old firewall rule, an admin account without MFA, a server that missed its updates.
Talk to our team today. Mon–Sat, Dubai time.
What we do
What we look at, and what you get back.
We run assessments and coordinate specialist testing where needed.
22+ years · 5,000+ clients served since 2004 · 10,000+ projects delivered since 2004
- Vulnerability assessment
- Internal and external scans of servers, laptops, network devices and public IP addresses, with each finding rated and explained.
- Penetration testing
- Scoped with you and carried out by a specialist tester we coordinate, for applications, external perimeter or internal network.
- Microsoft 365 security review
- MFA, admin roles, conditional access, mail rules, external sharing and Defender settings checked against a practical baseline.
- Firewall audit
- Rules exported and reviewed, unused and over-wide rules flagged, firmware and subscription status checked, VPN access listed by user.
- Backup and recovery check
- Whether backups are complete, offline or immutable, and whether a restore actually works.
- Report and fix plan
- Findings in order of risk with plain explanations, the fix for each and a re-test once they are closed.
How a project runs
Survey, fixed quote, then a staged rollout with a way back.
-
Step 1
Site survey
An engineer visits, records what is installed today and what the business needs from it, before anything is priced.
-
Step 2
Fixed quote
You get an equipment list, the labour, a schedule and one written price. Anything that changes on site is quoted in writing first.
-
Step 3
Staged rollout
One site, floor or group at a time. The old setup stays in place, with a tested way back, until the new one is proven.
-
Step 4
Handover and support
Documentation, admin access in your company’s name and a walkthrough. Then support under an AMC or managed IT if you want it.
After go-live
After the report.
- A walkthrough of the findings with your IT and management.
- Fixes carried out by our team as a fixed-price project, or handed to your own team with notes.
- A re-test of the items that were fixed.
- Evidence you can use for client, insurer or auditor security questionnaires.
- An optional repeat assessment each year, or after a major change.
- Ongoing monitoring under managed cybersecurity if you want it.
Support runs Monday to Friday 08:30–17:00 and Saturday 08:30–14:00 (Dubai time), with out-of-hours cover agreed in the contract where you need it. We reply within one business day to anything that is not urgent. See IT AMC contracts and managed IT services.
Questions
What buyers ask before they sign.
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment scans your systems and lists known weaknesses with a severity for each. A penetration test goes further: a tester tries to exploit them, the way an attacker would, to show what could actually be reached. Most businesses start with the assessment and test the systems that matter most.
Who carries out the penetration testing?
We run assessments and coordinate specialist testing where needed. Where a full penetration test is required, for example by a client contract or a regulator, we scope it with you, bring in a specialist tester, manage the engagement and then fix what it finds.
What does a Microsoft 365 security review look at?
Sign-in and MFA settings, admin accounts, conditional access, mail forwarding rules, external sharing in SharePoint and OneDrive, Defender settings and the Secure Score recommendations that matter for your size. You get a list of changes in order of risk.
Will the testing disrupt our systems?
Scans are scheduled with you and run outside busy hours where needed. Anything that could affect a live system, such as testing a production application, is agreed in writing first, with a named contact on your side throughout.
We have a security questionnaire from a client or insurer. Can you help?
Yes. The assessment gives you evidence for most of the questions, and we help you answer the rest accurately, including the ones where the honest answer is "not yet, planned for next quarter".
How is an assessment priced?
A fixed quote based on the number of users, sites, external IP addresses and applications in scope. Fixing what the report finds is quoted separately, so you can choose what to do and when.
Tell us what needs assessing
Number of users and sites, what is in scope (Microsoft 365, firewall, servers, an application) and whether a client or insurer has asked for it. We reply within one business day.
Planning a project? Get it scoped first.
Send us the brief, the deadline and what you have today. An engineer reviews it and we reply within one business day with next steps.