Work with us
Services
Planned, scoped work for small organisations and professionals. Each service says what it covers, what you receive and what it leaves out. Prices and timing depend on the scope and are agreed after you get in touch.
How an engagement works
- You write to us with a short description of your organisation and what worries you.
- We reply with questions and agree on a scope: what is included, what is not and what we need from you.
- The work is done within that scope, and anything outside it is discussed before it starts.
- You receive the written output described for the service.
Security assessment
A structured look at accounts, devices, network and procedures, ending in a prioritised list of what to fix first.
Who it is for
Small organisations, clinics, offices and professionals who handle other people's data and have never had their set-up reviewed.
What it covers
- Account and sign-in practices: password manager use, multi-factor authentication, shared accounts.
- Updates, backups and whether a restore has ever been tested.
- Network and e-mail set-up at the level of the checklists in this section.
- Who can do what, and what happens when something goes wrong.
What you receive
A written summary of findings, ordered by the risk each removes, with the action proposed for each.
What it does not include
Penetration testing and attacks on systems; continuous monitoring.
Incident review and digital forensics support
Help to understand what happened after an incident, and to preserve evidence so that it can be relied on later.
Who it is for
Organisations and individuals dealing with a past incident: a compromised account, a malware infection, a data leak or a suspicious employee action.
What it covers
- Reconstructing the sequence of events from the records that exist.
- Advice on preserving devices, logs and messages without altering them.
- Linking the findings to the Forensic section's methods and procedures where a formal examination is needed.
What you receive
A written account of what can and cannot be concluded from the available material.
What it does not include
Emergency response to an attack that is still going on; legal advice.
Staff awareness sessions
A session for your team built on the training modules and decision scenarios in this section, adapted to the kind of work you do.
Who it is for
Teams that handle payments, customer data or shared mailboxes, and have never trained together on spotting fake messages.
What it covers
- Phishing, payment fraud and account protection, with scenarios close to your own day.
- What to do and whom to tell when a message looks wrong.
What you receive
The session itself and a short written summary of the points agreed for your team.
What it does not include
Certification of staff; testing employees with simulated attacks.
Website security review
A review of a site you own or administer: administrator access, updates, HTTPS, security headers and how forms and logins are handled.
Who it is for
Owners of business sites, shops and portals who want an outside opinion.
What it covers
- Configuration and header review, as the HTTP header tool in this section does, with an explanation of each finding.
- Access control, update and backup practice for the platform and its plugins.
What you receive
A written list of findings with the reason and the suggested fix for each.
What it does not include
Testing of any system without the owner's written permission, and any attack against a live service.
Incident and backup plans
Short, usable documents: who does what in the first hour, how backups work and how to restore them.
Who it is for
Small organisations that have no written plan and rely on one person's memory.
What it covers
- A one-page incident plan based on the first-hour checklist.
- A backup plan with the 3-2-1 rule applied to your own data, and a restore test to run.
What you receive
The documents, written with you, in your own words.
What it does not include
Operating your backups or your systems for you.
What this page does not offer
- No round-the-clock monitoring and no emergency response line. If an attack is under way now, contact your IT provider and your bank first; the first-hour checklist and the incident module in this section can help meanwhile.
- No fixed price list. The scope decides the work, so the price is discussed after contact.
- No testing of systems without the owner's written permission.
Contact
Choose the topic closest to your request; it opens a draft e-mail in your own mail program, with nothing sent until you send it. Please do not attach passwords, personal data or evidence files. How material is shared is agreed after first contact.
Free resources
Much of this work starts from material you can use yourself, at no cost and without contacting anyone.
This section is for defence and learning. Do not test systems you do not own or have written permission to test: unlawful access to an information system is an offence (Turkish Penal Code, Article 243).