Service · IT infrastructure

Infrastructure health check

Suppose you manage a metal components maker in Celje employing forty-five people. Your largest customer, based in Germany, sends a supplier information security questionnaire, while your insurer, renewing the cyber policy, wants proof of multi-factor sign-in and tested backups. At the same moment you are weighing up a new IT provider and a new server. Every one of those decisions rests on the same thing: a dependable account of what you own and what state it is in. Most firms lack exactly that, because IT has grown piece by piece and the knowledge is scattered across people and old email threads. The health check provides that account. We connect using accounts that can only read, change no settings and never set foot on your premises. Over two to three weeks we gather data, confirm whether backups really restore and talk to the people who use the systems daily. You receive a traffic-light report and a list of actions ranked by risk and estimated hours, written so that anyone can carry them out, not only us.

Read-only access
no settings touched during the review
Trial restore
we do not trust the success log
Traffic lights
red, amber, green per area
Hour estimates
for every recommended action

Scope of the service

The review covers seven areas. For each one we state what we found, how serious it is and how much effort fixing it would take.

Check the scope with an engineer

Devices and software inventory

Everything attached to the network: servers, PCs, printers, cameras, time-and-attendance terminals and the NAS forgotten in the meeting room. Alongside them, applications, licences and end-of-support dates.

What an outsider can see

Open ports on the firewall, the software version on your VPN appliance, certificates close to expiry, and the SPF, DKIM and DMARC records for your domain.

Identities and privileges

Accounts belonging to ex-staff, shared logins with no owner, people using admin rights for routine work, and multi-factor gaps across Active Directory and Entra ID.

Patching and lifespan

Which systems no longer get security updates from the manufacturer, which are behind on installing them, and when replacements will be due so you can put them in the budget.

Backups and recovery

What is copied, where to, how often, and whether any copy sits beyond the reach of ransomware. With your consent we restore a file or a whole virtual machine as a test and time it.

Network

Whether office, production, guest Wi-Fi and cameras are kept apart, how the firewall is configured, and whether anyone has outside access that nobody remembers granting.

Documentation and key-person reliance

Where passwords and procedures are written down, who knows them, and what would happen if that person were unreachable tomorrow. The biggest risks often sit here.

How the work runs

For a business with 20 to 60 workstations the review runs two to three weeks. Your team's total involvement is just a few hours.

01

Kick-off call

In 45 minutes we agree the reason for the review, the sites, key applications and deadlines. A data processing agreement and a confidentiality agreement are signed.

02

Data gathering

Temporary read-only accounts are opened and an inventory agent is deployed. In parallel we look at your public addresses from outside.

03

Verification and interviews

A trial restore, a look inside admin consoles and brief conversations with two or three system users. That is how we spot what tools miss.

04

Report and walkthrough

A few pages of management summary plus a technical appendix of actions. We present both on a video call and take questions.

One person who knows everything is a risk no scanner will flag. Reviews often show that everything works technically as long as one particular individual is around: an outside technician, the owner's son or a long-serving bookkeeper who knows where the router password lives. That dependency does not look like a vulnerability, yet illness, a resignation or a dispute can leave the company unable to get into its own systems. Our report therefore treats it as seriously as an open port on the firewall.

Your questions answered

We charge €50 per hour plus VAT. Before starting, we send an hours estimate based on workstations, servers and sites, and for a tightly defined scope we can quote a fixed price. The review places you under no obligation to keep working with us.

No. The inventory agent and read-only access go unnoticed, and the trial restore is done in an isolated environment or at an agreed time. All we need from staff is a few short conversations.

No. The review follows ISO 27001 principles and shows where you stand against them, but we do not issue certificates. If you decide to pursue certification, we can help you prepare.

That depends on your sector, size and position in the supply chain. Our report gives an initial view and a list of measures that NIS2 and ZInfV-1 expect. A binding legal opinion should come from your legal adviser.

Critical findings, such as an admin interface open to the internet or a backup that has not run for months, are reported to you the same day rather than held for the final report. You can fix them yourselves, with your current provider or with us.

Book an infrastructure health check

Tell us how many workstations and sites you have and why you want the review. Within one working day we will propose a kick-off slot and a rough hours estimate.

When we work
Weekdays 9:00-17:00 CET, answers the same or next working day
Calls
Video meetings, Teams and Meet both welcome

We set essential cookies only: the ones that keep the site running and recall which town you chose. Nothing for ads and nothing that follows you around the web. Details are in our privacy and data protection notice.