Security
Many incidents start with a missed update. We build it, audit it, run it.
Running servers since 2015, now AI systems too. For us, security isn't a checkbox; it's the foundation of operations.
Why it matters
4% of annual global turnover or €20M fine — whichever is higher.
Mandatory EU-wide since 2024, and in force in Hungary.
Average data breach cost globally in 2024 (IBM).
New vectors: prompt injection, RAG data leaks, tool abuse. These already show up in live apps.
01 · Traditional
What we've learned since 2015.
Software security isn't one layer. We cover it from code to infrastructure, from application to process, and tell you when an external expert should be involved.
- Penetration testing
- OWASP-based web and mobile pentests at application and infrastructure level.
- Security hardening
- Firewalls, VPN, access control. IaC review (Terraform, Ansible).
- Continuous monitoring
- Log aggregation and automatic anomaly detection. We respond during business hours, beyond that under a custom SLA. Written review after significant incidents.
- Backup, DR, BCP
- Regularly tested restores, not just "we have backups". Measured recovery time and data-loss window (RTO/RPO).
- Compliance
- GDPR, NIS2, DORA, and sector-specific rules. We help you prepare the documentation an audit needs.
- Secure SDLC
- Static analysis (SAST), dependency scanning, secret detection, CI-blocking checks.
02 · AI-assisted
Where AI makes us more effective.
AI doesn't replace the specialist, but it filters out the noise, leaving more time for real risks.
AI-assisted code review
Automated review of code changes, flagging vulnerability patterns, leaked secrets, and dependency risks.
AI security checks
Regular infrastructure and configuration scans, with a language model interpreting and ranking the findings.
Alert pre-screening
A language model helps with the first pass on alerts. People make the critical calls.
03 · AI systems
New attack surface, new defense.
LLM apps introduce new kinds of vulnerabilities. We prepare for them specifically and test for them before launch.
Prompt injection testing
Before launch, we attack your AI application ourselves: jailbreaks, data exfiltration, tool abuse.
Data access in RAG systems
Permissions, personal data redaction, logged queries.
Model access control
Who can use which model, with which data, and within what budget. Rate limits, automatic spending caps.
Output filtering
Rule-based checks on AI agent responses: personal data, harmful content, confidential information.
Models on your own infrastructure
Your data stays on your infrastructure. For regulated clients, this is often the simplest answer to 'can we use a cloud LLM?'
Not sure where you stand?
Start with a one-hour assessment conversation that leaves you with a clear picture of where you stand. We reply within 2 business days.