Cybersecurity

What we do

1. 01Security review of websites, web apps and internal software.
2. 02Penetration testing: with your written permission and an agreed scope, we try to break in the way an attacker would, and show you what we found.
3. 03Hardening of servers and networks: access, updates, backups, logging and encryption.
4. 04Security of connected devices and factory systems: IoT, embedded firmware and machine networks.
5. 05Training for your team: the habits and checks that prevent most incidents.
6. 06Help when something goes wrong: contain it, find the cause, restore, and prevent a repeat.
7. 07Preparation for ISMS and for Korea's personal-information law (PIPA): we check your technical protections and help you get ready. We do not issue certifications.

How it works

It starts with a paid assessment, as in all our projects: we look at your systems, list the risks in order of importance and estimate the work to fix them. You get a clear report, and you decide whether we fix them, you do, or someone else does. If we are not the right fit, we tell you. We work only with your written permission and an agreed scope. We do not test critical information infrastructure (for example energy, telecom, finance and public bodies): the law reserves that to designated bodies.

Three ways to test

1. From the outside (black box). We get only the public addresses you name: the website, the app, an IP range. We do what an attacker on the internet would do, within the agreed scope and time. Good for a first, realistic look at what anyone can see, or when you cannot share code. The limit: problems hidden in the logic, keys inside the code and old libraries often stay invisible.
2. With an account (grey box). We get test accounts for each role (customer, staff, administrator), the documentation and the API description. We do the outside test plus what a logged-in user, or a stolen account, could reach: other customers' data, administrator functions, payments. The usual choice for web apps, portals and shops, where most of the risk sits behind the login.
3. With the source code (white box). We get the code, the configuration and a short walk-through of the architecture. We review the code and test the running system, so we find more problems in fewer hours, and we point to the exact line and the fix. We build software and hardware ourselves, so we read code the way your developers do. Best for software you own or had built for you, before a launch and after a big change.

Our advice

If the code is yours, choose the white box: it finds more, in less time. If it is not, choose the grey box. The outside test is the quick first look. You can also mix them, system by system.

Your code stays yours

1. Handed over through a secure channel we agree in writing, not by ordinary email. You confirm what was handed over. We keep it encrypted, and only the named people on the project can open it.
2. Used only for your test. We do not reuse it and we do not enter it into any tool, service or AI model that keeps or learns from what it receives.
3. No copy remains. At the end we return or delete the code and the working data irreversibly, and confirm it in writing if you ask.
4. No right in your code passes to us. If part of the code belongs to a supplier of yours, you confirm that you may share it with us, or tell us which parts to leave out.

Before you decide

1. Do you need our source code? No. You choose: from the outside, with an account, or with the code. The code finds more.
2. Can the test break our systems? We agree the time window and the techniques beforehand. Attacks that could stop a service are excluded unless you ask for them in writing, and you can stop the test at any moment.
3. Who sees our code and data? Only the people named in the agreement. Nothing is kept after the test.
4. Do you test our hosting or cloud provider? Only with their permission or within their rules. We give you a one-page authorisation letter to send them.

What you receive

A written report in all three modes: what we tested and how, each finding with its severity and how to reproduce it, recommendations in order of priority, and a one-page summary for management. One retest of the fixed findings is included. Further retests are quoted separately.