Yes. We adapt the scope, schedule, and safety rules to the criticality of the controlled processes. Higher-risk scenarios are performed only by agreement, during a planned shutdown, or in a separate testing environment.

We design testing to minimize the risk of outages or interference with physical processes. Potentially dangerous actions are not performed in active production environments without explicit approval.

Yes. We assess corporate IT infrastructure, industrial networks, control systems, and the connections between them. This allows us to uncover potential attack paths from the corporate network into the OT environment.

Yes. We adapt the testing approach to the age, sensitivity, and availability of the system. For devices that cannot be safely tested actively, we use configuration reviews, communication analysis, or testing in an isolated environment.

Yes. We test VPNs, remote administration, service accounts, and access granted to external suppliers. We assess whether compromised access could provide a path into the industrial network or control systems.

Yes. We assess PLCs, HMIs, SCADA and DCS systems, engineering workstations, industrial protocols, access permissions, and opportunities to modify configurations or controlled processes without authorization.

Yes. The results can provide technical evidence for cyber risk management and verification of security controls under NIS2 or IEC 62443. Testing does not, however, replace legal assessment, certification, or a comprehensive compliance audit.

We begin by mapping the IT and OT architecture, critical processes, communication flows, remote access, and operational constraints. Based on the identified risks, we define the systems to be tested, permitted scenarios, and a safe testing approach.

You will receive a technical report describing the vulnerabilities, supporting evidence, risk ratings, and specific remediation recommendations. We also evaluate findings according to their potential impact on production, supplies, and physical processes.

Yes, a retest can be included in the agreed project scope. Once remediation is complete, we verify whether the vulnerabilities have been properly resolved and whether the changes introduced any additional security risks.