A security audit answers one question: where does your IT really stand? Not what the documentation says, but what is measured. You get a report that backs up every finding, rates it and attaches a concrete recommendation. Plus one page with the three things to do first.
What you get
- Audit report: every finding with evidence (what was measured where), a rating (immediate / soon / watch) and a fix recommendation.
- Priority list on one page: the three items to tackle first.
- Follow-up check on request: the same measurements after remediation; the report shows what is closed and what remains open.
What is reviewed
Only systems you own or operate and that you commission us in writing to audit.
- Virtualisation and storage: Proxmox VE and PBS, ZFS, snapshots, replication, the backup chain up to a restore test.
- Firewall and network: OPNsense, FortiGate: rulesets, remote access, VPN, patch level, logging.
- Servers and containers: Linux servers and Docker hosts: patch state, running services, open ports, users and keys.
- Mail and web: deliverability, SPF/DKIM/DMARC, TLS, externally exposed services.
- Monitoring: would an outage or intrusion be noticed at all, and by whom?
How the work is done
- Read-only. We measure, we do not change. Any change stays with you or is commissioned separately.
- No attacks. No penetration testing, no exploitation, no third-party systems.
- A human decides. Analysis is AI-assisted (Anthropic Claude, used under the Cyber Verification Program for verified security teams). Every finding is checked; the report is approved and signed by Ronald Wiesinger.
- Your data. You receive the report. Measurement data is kept only as long as a follow-up check is running. Credentials never appear in the report.
With an in-house IT team
An audit does not replace your IT team, it gives it an outside view. Whoever runs a system every day stops seeing their own habits; we arrive without assumptions and measure. The report goes to your team, in its language: finding, evidence, recommendation, priority. Remediation and the follow-up check are done by you, or together with us, whichever suits you. We do not compete with your IT department, we hand it arguments.
Process
- Engagement and access: scope agreed in writing, read-only access set up.
- Assessment: usually one to three days, without downtime.
- Report and review: one meeting, one hour, priorities settled.
- Follow-up check (optional): after four to eight weeks.
What it is not
Not a penetration test, not a managed security service, not a certification. If you are heading for ISO 27001 or NIS 2, the audit is the groundwork, not the certificate.
Partner review: pve-zfs-tool and SAMADCON
For the open-source tools by Dennis Bäumer (pve-zfs-tool, SAMADCON) we act as the external security reviewer: new versions are checked for vulnerabilities with AI assistance before they go into our own environment, findings go to the maintainer with a test case, and the fix is re-measured. Documented in the project’s security policy; the October 2026 findings were fixed in versions 0.9.935 and 0.9.936, within 24 hours.