Devices and software inventory
Everything attached to the network: servers, PCs, printers, cameras, time-and-attendance terminals and the NAS forgotten in the meeting room. Alongside them, applications, licences and end-of-support dates.
Suppose you manage a metal components maker in Celje employing forty-five people. Your largest customer, based in Germany, sends a supplier information security questionnaire, while your insurer, renewing the cyber policy, wants proof of multi-factor sign-in and tested backups. At the same moment you are weighing up a new IT provider and a new server. Every one of those decisions rests on the same thing: a dependable account of what you own and what state it is in. Most firms lack exactly that, because IT has grown piece by piece and the knowledge is scattered across people and old email threads. The health check provides that account. We connect using accounts that can only read, change no settings and never set foot on your premises. Over two to three weeks we gather data, confirm whether backups really restore and talk to the people who use the systems daily. You receive a traffic-light report and a list of actions ranked by risk and estimated hours, written so that anyone can carry them out, not only us.
The review covers seven areas. For each one we state what we found, how serious it is and how much effort fixing it would take.
Everything attached to the network: servers, PCs, printers, cameras, time-and-attendance terminals and the NAS forgotten in the meeting room. Alongside them, applications, licences and end-of-support dates.
Open ports on the firewall, the software version on your VPN appliance, certificates close to expiry, and the SPF, DKIM and DMARC records for your domain.
Accounts belonging to ex-staff, shared logins with no owner, people using admin rights for routine work, and multi-factor gaps across Active Directory and Entra ID.
Which systems no longer get security updates from the manufacturer, which are behind on installing them, and when replacements will be due so you can put them in the budget.
What is copied, where to, how often, and whether any copy sits beyond the reach of ransomware. With your consent we restore a file or a whole virtual machine as a test and time it.
Whether office, production, guest Wi-Fi and cameras are kept apart, how the firewall is configured, and whether anyone has outside access that nobody remembers granting.
Where passwords and procedures are written down, who knows them, and what would happen if that person were unreachable tomorrow. The biggest risks often sit here.
For a business with 20 to 60 workstations the review runs two to three weeks. Your team's total involvement is just a few hours.
In 45 minutes we agree the reason for the review, the sites, key applications and deadlines. A data processing agreement and a confidentiality agreement are signed.
Temporary read-only accounts are opened and an inventory agent is deployed. In parallel we look at your public addresses from outside.
A trial restore, a look inside admin consoles and brief conversations with two or three system users. That is how we spot what tools miss.
A few pages of management summary plus a technical appendix of actions. We present both on a video call and take questions.
One person who knows everything is a risk no scanner will flag. Reviews often show that everything works technically as long as one particular individual is around: an outside technician, the owner's son or a long-serving bookkeeper who knows where the router password lives. That dependency does not look like a vulnerability, yet illness, a resignation or a dispute can leave the company unable to get into its own systems. Our report therefore treats it as seriously as an open port on the firewall.
We charge €50 per hour plus VAT. Before starting, we send an hours estimate based on workstations, servers and sites, and for a tightly defined scope we can quote a fixed price. The review places you under no obligation to keep working with us.
No. The inventory agent and read-only access go unnoticed, and the trial restore is done in an isolated environment or at an agreed time. All we need from staff is a few short conversations.
No. The review follows ISO 27001 principles and shows where you stand against them, but we do not issue certificates. If you decide to pursue certification, we can help you prepare.
That depends on your sector, size and position in the supply chain. Our report gives an initial view and a list of measures that NIS2 and ZInfV-1 expect. A binding legal opinion should come from your legal adviser.
Critical findings, such as an admin interface open to the internet or a backup that has not run for months, are reported to you the same day rather than held for the final report. You can fix them yourselves, with your current provider or with us.
Tell us how many workstations and sites you have and why you want the review. Within one working day we will propose a kick-off slot and a rough hours estimate.
Enquiry received
An engineer will write back no later than the following working day. Faults that leave your staff unable to work are always looked at first.
No town by that name here. Check the letters, or settle for the nearest larger place. Our engineers work only over the internet, so Kočevje and Koper get precisely the same treatment.