Cybersecurity
Take a forty-person firm in Novo mesto that machines components for car makers. During one busy month its carmaker client bolts a cyber questionnaire onto the yearly vendor audit, the broker handling its insurance asks for proof that two-step sign-in covers every account, and the bookkeeper opens a message, seemingly from a long-standing supplier, saying payments should now go to a different bank. They feel like unrelated problems. Underneath sits a single test: can the firm prove its safeguards, and would those safeguards hold up for real? Our cybersecurity work delivers both halves, the paperwork that GDPR, ZVOP-2 and information security legislation expect and the hands-on controls that make that paperwork honest. Everything runs remotely, through video meetings and audited remote sessions.
Regulation and evidence
Data protection law, NIS2 and ZInfV-1, procurement checklists from large buyers and underwriting forms from insurers are phrased differently, yet they circle the same themes: access, risk judgement and incident handling. Lay one solid base and every one of them gets answered. Our method draws on ISO 27001, with the Information Commissioner's guidance and SI-CERT material as practical signposts, and DORA joins the picture for clients in banking, insurance or investment.
GDPR and data protection
Privacy from the IT side: locating the systems behind each line of your processing register, controlling who opens them, answering subject access and deletion requests without panic, and knowing the drill once a breach is discovered.
Security policies and documentation
Written rules, risk scoring and incident playbooks built from interviews with your staff, never from an off-the-shelf template. Because they mirror how you genuinely operate, auditors and demanding clients find nothing hollow in them.
Technical protection
Nine services covering identities, endpoints, network, applications, databases, web traffic and the movement of data. Nobody buys the full set on day one; weighing your risks tells us which jump the queue and which can sit until next year.
Security tooling roll-out
Ideal when a premium Microsoft 365 subscription is mostly untouched, or an EDR licence has done nothing but observe since it was bought. Trial users first, then waves, then real enforcement, all while work carries on.
Infrastructure security
Exposed RDP disappears, CCTV and visitor wireless get walled off in separate zones, and outside contractors log in individually with two-step verification rather than borrowing one communal password.
Application security
Settling questions like these: which Pantheon or Minimax users may edit bank details, whose credentials power the marketplace sync, and in which file or vault the Stripe or Bankart secret currently lives.
Data leak prevention (DLP)
Documents carrying an EMŠO, bank account numbers or lab results get spotted automatically. Sending one to a webmail address triggers a gentle warning first; outright stops are rare, and employees learn the rules before anything switches on.
Database security
That widely known built-in administrator password stops working, SQL Server and MySQL data gets encrypted, lookups in sensitive tables leave an audit trail, and forgotten dump files are cleaned off the server.
Web application firewall (WAF)
Cloudflare or a host-provided filter, calibrated well before Black Friday and December peaks, so scripted card checks and credential stuffing hit a wall and real customers sail through to payment.
Access control and endpoint security
Phished credentials become useless: every user verifies twice, only Intune-enrolled laptops and phones may open business data, and day-to-day accounts run without administrator privileges.
VPN and encryption
Modern WireGuard or IPsec tunnels joining your locations, BitLocker everywhere with recovery keys escrowed in Entra ID, and a dependable encrypted channel for payroll files bound for the bookkeeper.
Vulnerability scanning
A monthly look at you from outside and within, prioritising SI-CERT alerts and weaknesses already abused in the wild. Less paper, more fixes that actually land.
Monitoring and ongoing care
Security set up in spring drifts by winter as people join, software changes and criminals adapt. The following four services carry on quietly once the launch project is over.
Where to begin?
When money is tight, getting the order right beats picking the perfect product. For teams of 10 to 250 we recommend this sequence, which deals with the favourite attacker routes early.
Who expects what from you?
In one online session we collect every demand you face, from clauses in client agreements and the insurance questionnaire to GDPR obligations and, for sectors inside NIS2, the national rules. The result tells us what proof you must produce and which data deserves the strongest protection.
Accounts and email
Verification on every login, removal of leftover accounts from people who have moved on, and filters for counterfeit invoices and bank-detail scams. Smaller companies are most often breached here, and fixing it costs least.
Devices, network and backups
Endpoint protection in enforcement mode, sensible hardening, nothing reachable remotely without a secure gateway, and a backup proven by a real restore. Ransomware is halted, or at least boxed in, at this stage.
Documentation and monitoring
Once the groundwork exists, written policy can describe reality rather than ambition. Extra layers follow only where risk warrants them, whether that means a WAF, DLP, tighter zoning or round-the-clock log review.
Before anything else, put a price on seven days with no working IT. Suppose a web shop takes €4,000 daily, or a distribution hub cannot print dispatch papers and load trucks while its system is down. A few lost days can easily exceed twelve months of sensible protection. That number, more than worry about penalties, should set your budget and priorities.
Frequently asked questions
The rules target organisations classed as essential or important, a status driven largely by industry and headcount. Your lawyer should confirm whether you are directly covered, and URSIV, the national information security office, publishes guidance too. More commonly, firms outside scope still feel the effect because a covered client starts sending security checklists and revised contract clauses. We help assemble the technical replies and supporting proof.
Not until you have checked with the supplier using contact details from your own records rather than from the message. Behind such scams there is typically a hijacked inbox on one side or the other, with the fraudster quietly following the thread until an invoice falls due. We inspect inbox rules, login history and headers, lock out any intruder and put DMARC, SPF and DKIM right. Long term, insist that a second colleague signs off every change to payee details.
Jointly, we split the items into things already true, things fixable quickly and things needing proper investment. Verified logins, written access permissions, an agreed incident routine and a fresh scan report typically satisfy the bulk. Claiming controls you lack can backfire badly, since after an incident both the client contract and the insurance policy may be read against you. Where ISO 27001 certification is demanded, we get you ready for the audit.
Do not power anything off; isolate affected machines from the network instead, so evidence is preserved. Using a device you trust, reset administrator credentials and write to support@apply.si, or helpme@apply.si for contract clients. Where personal data may be involved, the Information Commissioner must normally hear within 72 hours. SI-CERT accepts incident reports as well and offers assistance.
It is. We meet over Teams or Google Meet and configure systems through recorded, encrypted remote sessions. Should cabling or hardware need touching, a colleague of yours or a nearby technician does it with us coaching on video. Once the initial review is done, the schedule goes into our written quote.
Related areas
Describe the demands you face and where you stand now
Whether it is a client checklist, an insurance renewal, GDPR or NIS2 groundwork or a nagging suspicion, a remote review will show the gaps, the sensible sequence and the likely budget.
Weekdays 9:00-17:00 CET, answers the same or next working day
Video meetings, Teams and Meet both welcome
Enquiry received
An engineer will write back no later than the following working day. Faults that leave your staff unable to work are always looked at first.
- Questions first. If something is missing before we can estimate, we email you or set up a brief video chat.
- A written quote. It spells out the work, a euro figure excluding VAT and a sensible start date. No fine print, no surprise line items down the road.
- You choose. It lands in your mailbox. Read it at your own pace, query anything that seems vague, and only then make up your mind.