External exposure
What an attacker sees of your company from the internet. Domains, published services, open ports, exposed versions, and company credentials sitting in somebody else's breach.
Cybersecurity
A cybersecurity audit that ends in a plan you can act on
Before you spend money on protection, it helps to know where you are exposed. We review what the internet can see of you, who can get into what, the state of your machines and your backups, and how well your site and your software hold up. You end up with two reports and a plan ordered by risk and by cost.
- Independent of vendors and license resellers
- Everything under an NDA signed first
- Fixed price agreed before we start
- We read your code as well as your perimeter
NginxApacheAWSMySQLSQL ServerMongoDBRedisPHPNode.jsGit
Why now
Attacks pick the open door, not the company
Most of what reaches you is automated and indiscriminate. Malicious software tries one door after another and keeps whichever one gives, and your revenue has nothing to do with which door that is.
Two newer reasons push the audit up the list. Large customers now send security questionnaires to their suppliers, and somebody has to answer them with real answers. Privacy rules put a duty on you to protect customer information and to report a breach. An audit puts you in front of both.
They look for open doors
Automated
They try one door after another and keep whichever one gives.
Scope
What the audit looks at
Access and passwords
Who can get into what, with which permissions and from where. Live accounts belonging to people who left, shared passwords, missing two factor, and vendor access nobody tracks.
Machines and updates
The state of the laptops and servers in the company. Systems behind on updates, software out of support, and configurations nobody has looked at in years.
Backups and recovery
The question is not whether you take backups. It is whether they restore. We look at what gets copied, how often, where it lands, whether it sits out of an attacker's reach, and whether anyone has run a full restore.
Your site and your software
We read the inside of your site, your store and your applications, custom code included. Forms, sessions, permissions, integrations and customer data.
People and procedures
The link that starts the most incidents. How exposed your team is to phishing, and whether the basics are written down: what to do with a suspicious email, who signs off on a change to a vendor's bank details.
The handoff
What you get when it is done
Three pieces, all three built so that something happens next.
The handoff
Three pieces
Executive report
For management. Twenty minutes to read.
Technical report
Every finding with its evidence and its fix.
Prioritized action plan
- An executive report for management. What your risk is, where it sits and how serious it is, in business language. Twenty minutes to read.
- A detailed technical report. Every finding with its evidence, its risk and the recommended fix, ready for whoever does the fixing: your team, your usual IT person, or us.
- A prioritized action plan. What to correct first, by risk and by cost, with the low cost measures flagged. Plenty of the important fixes come down to configuration.
Cover
Overnight for you is the middle of our working day
That is useful at exactly the hour you want it to be, and it is the reason the continuous plan exists. On a continuous security plan, what gets watched and the response times attached to it are agreed in the contract and signed before anything starts. During an audit the rule is simpler: anything serious reaches you the moment we see it, not in the final report. Cristian Fernández, CTO of STRADA DEV, runs the work and is the name on your calls.
Fit
When an audit pays for itself
05 signalsIt pays for itself when:
- Nobody has ever looked at your security properly, start to finish.
- A large customer sent you a security questionnaire and you cannot answer half of it.
- Your revenue runs through your site, your store or your own software.
- You had a scare. A fake invoice that nearly got paid, or one machine that got infected.
- People reach your systems from home, from the road and from their own laptops, and no list says who can get into what.
03 casesAnother option suits you better if:
- An attack is running right now. That is an incident, so your response contact and your insurer come first. The audit comes after.
- You want antivirus on the laptops. Your usual IT provider covers that.
- You need a named certification by a deadline. That is a compliance project, and it is different work from a technical audit.
After the audit
The audit is the snapshot. Keeping it current is the rest
The audit is one day’s photograph. A continuous plan is the part that keeps working after it: we fix the findings alongside your team, repeat the review on a schedule so the picture does not go stale, and harden the servers already under watch in managed services.
We build software too, so security goes into our custom software development from the design stage. Reading code, ours and other people's, is part of the daily work.
Continuous security
After the audit
The audit is the snapshot. Scheduled reviews, and fixing the findings with you, are the movie.
Method
How the audit runs
- Scope and confidentiality.
We agree what gets reviewed, how deep and on what dates, and sign an NDA. The scope and a fixed price reach you in writing before anything starts.
- Gathering what we need.
A short interview with whoever knows the systems, plus the access we agree on. The calendar gets built so your team keeps working.
- Review and agreed testing.
Exposure, access, machines, backups, the site and the software, with every test agreed in advance and safe for your operation.
- Two reports.
We write the executive one and the technical one. Both documents are yours.
- Presentation, then the plan.
We walk you through the findings in a session and hand over the plan ordered by risk and cost. You decide what gets fixed, by whom and when.
How you buy it
Two ways to contract it
A one off audit
A closed project with scope, price and dates in writing. It is the usual way in, and it commits you to nothing after it.
A continuous security plan
Reviews on a schedule, the fixes made alongside your team, and watch kept on the parts that matter, for a monthly fee agreed in writing. For companies whose day stops when their systems do.
What we review it with
The technology we go through
- Servers and proxies:Nginx and Apache
- Cloud:AWS
- Databases:MySQL, SQL Server, MongoDB and Redis
- Applications:PHP and Node.js
- Code and its history:Git
- Read by hand:your code and the configuration that matters
- Backups:checked with a real restore test
Where we work
The industries we work in most
An audit earns its keep fastest where an outage costs money by the hour. Plant and ERP systems in manufacturing, order and tracking platforms in logistics, stores holding customer records and card payments in ecommerce, and the customer data sitting inside a SaaS product. It lands the same way in construction, where project and payroll systems hold the subcontractor data, in automotive, in hospitality, and across multi location operators running one set of systems from many sites.
Common situations
Three situations we walk into
Illustrative, and one of them will sound familiar.
01Situation
A manufacturer gets a long security questionnaire from its largest customer and has no idea where to start.
Solution
The audit gives real answers, plus a plan for the gaps the questionnaire exposes.
02Situation
A company gets its files encrypted and finds out that night that the backup had been failing for months.
Solution
A restore test would have caught that while there was still time.
03Situation
An online store holds customer records and card payments on a platform nobody has looked at since launch day.
Solution
The audit reads the store from the inside, not just the perimeter around it.
Investment
What a cybersecurity audit costs
It tracks the size of what has to be reviewed. These are the five things that move the number.
- How many people, and how many machines
- How many systems, sites and applications are in scope
- How deep the agreed testing goes
- Whether the software is custom and the code has to be read
- Whether the fixes get done with you, or you take the audit alone
The figure that puts it in context is what a week of downtime costs you: a team sitting idle, the technical recovery, the orders that go to somebody else while you are dark, and the calls to the customers whose records were in there.
The scope, the price and the dates come to you in writing in the proposal, counted from the day the scope is agreed.
Why us
Why companies pick STRADA 360 to run the audit
Look at what a security firm sells, because that shapes what it recommends. Here is what we put in writing.
Our revenue comes from your audit, not from a license or anybody’s product. The report recommends what your case needs, and it starts with the cheap fixes.
We build software every day, so your site and your own code get read alongside the perimeter.
One to decide with, one to work from, both under an NDA. Hand them to whoever does the fixing.
You know the scope and the price before anything starts, and the remediation gets quoted in phases you pick.
Questions people ask before they let us look
An audit means handing over access and hearing bad news. These three settle it.
Tell us how it is set upEvery test is agreed with you in advance, run with methods that are safe for your operation, and scheduled for the hours that get in the way least. Your company keeps working through the review, and you know what is being tested and who is doing it.
All of it sits under an NDA signed before we start. The findings, the reports and the evidence are yours and nobody else's. Your company name and anything from the audit get used only with your written permission, including as a commercial reference.
Yes. It gives you the real picture to answer the questionnaire truthfully, a plan for the gaps it exposes, and evidence that security has a budget and an owner. More large customers ask their suppliers for this every year.
Next step
Start with who can get into what
Plenty of incidents begin with an access nobody revoked or a backup nobody ever restored. Tell us how it is set up. You hear back within one to two business days and we put the scope of your audit together.
Write to us