Critical
0–30 days
- close exposures
- fix critical vulnerabilities
- secure access
IT systems audit & assessment Cybersecurity audit: assess your vulnerabilities before an attacker does
We carry out a complete IT security audit to assess your attack surface, systems, access, configurations and security practices. You get a clear view of the identified vulnerabilities, their severity and the remediation actions to take first.
Vulnerability report within 5 days
ISO 27001 & CISA certified experts
Total confidentiality guaranteed
What you get
At the end of the cybersecurity audit
Mapping, attack surface, ranked vulnerabilities, executive summary, technical report and a 30 / 60 / 90-day remediation plan.
5–15
days
100%
confidential
0
flaw overlooked
1 in 2 SMEs suffered a cyberattack in 2024 — a preventive audit costs 20× less than a breach
Understand
What is a cybersecurity audit?
A cybersecurity audit examines an organisation’s IT environment to identify its vulnerabilities, misconfigurations, organisational weaknesses and the scenarios an attacker could exploit.
Unlike a simple automated scan, the audit combines technical analysis, system configuration, access, internal practices and the level of risk control.
Identify
Exposed assets and vulnerabilities.
Assess
Likelihood and potential impact.
Prioritise
Flaws that require immediate correction.
Remediate
Build a remediation roadmap.
Our cybersecurity services
Cybersecurity audit
Complete IT assessment: systems, networks, access, applications and sensitive data.
Penetration testing (pentest)
Real attack simulation to identify exploitable vulnerabilities before hackers do.
IT security policy (ISSP)
Define and formalise your security rules, access, incident management and IT compliance.
Cyber attack protection
Deploy technical and organisational measures to block and detect attacks.
Scope of work
What a complete cybersecurity audit includes
A structured audit covering all attack vectors — technical, organisational and human.
Attack surface mapping
Inventory of exposed assets, entry points, public services and potential attack vectors
Technical systems audit
Servers, workstations, network, cloud — complete analysis of IT infrastructure
Configuration analysis
Settings, hardening, gaps and exploitable misconfigurations
Access & privileges review
Identity management, privileges, MFA, dormant accounts and password policies
Vulnerability analysis
Identification and classification of technical flaws by severity — distinct from a penetration test
Security practices analysis
Policies, procedures, internal habits and actual risk control — not documentation alone
Complementary technical tests
Scan, exposure testing or pentest depending on scope
Report & remediation plan
Report ranked by severity and prioritised corrective actions, with owners and timelines
Methodology
How does a cybersecurity audit work?
Carrying out an IT security audit follows a readable method: we scope, map, analyse, qualify the risks, then deliver a report and a prioritised action plan.
Hover or select a step to see the details.
-
Scoping
We set the audit frame before any analysis, so the diagnosis stays useful and workable.
- scope
- assets
- objectives
- constraints
-
Mapping
We reconstruct the IT environment as it actually exists, not only as it is documented.
- systems
- services
- exposure
- dependencies
-
Analysis
We examine the technical and organisational gaps that actually open a weakness.
- configurations
- access
- vulnerabilities
- practices
-
Complementary tests
Depending on the scope: scan, exposure testing or a pentest if the risk justifies it. They are not systematic.
-
Risk qualification
Each finding is read through impact + exposure + criticality, not through the technical flaw alone.
-
Report
Findings and evidence, structured so leadership and technical teams can both use them.
-
Remediation plan
Actions ranked by priority, with a realistic order of execution rather than a wish list.
-
Debrief
Presentation to leadership / technical teams, so everyone shares the same diagnosis and the same priorities.
01 Scoping
We set the audit frame before any analysis, so the diagnosis stays useful and workable.
Audit deliverables
What you receive at the end of your cybersecurity audit
A file leadership can read and IT can act on — not just a vulnerability report and a list of actions.
Map of the audited scope
Systems, services and assets actually covered by the engagement.
Identified attack surface
Entry points, exposed services and observed vectors.
Vulnerability list
Technical and organisational findings, with the context of each gap.
Severity classification
Critical, high, moderate, low — so you treat first what actually matters.
Executive summary
What leadership needs to decide, without reading the full technical file.
Detailed technical report
Findings, evidence and recommendations technical teams can use.
Remediation plan
Actions to take, with a realistic order of execution.
30 / 60 / 90-day prioritisation
What must be treated immediately, then over the following two months. See the roadmap.
Debrief meeting
Presentation to leadership / technical teams, so everyone shares the same priorities.
Optional — re-audit after correction. Once critical actions have been treated, we can re-check the relevant scope to confirm the gaps have been closed. This step is not included by default: it is agreed in the quote, like remediation follow-up on the more complete packages.
30 / 60 / 90-day plan
From audit to remediation: your roadmap
Actions are sequenced by actual urgency: first what is exposed, then what structures the posture, then what improves it.
Structuring
30–60 days
- configurations
- procedures
- hardening
- backups
Improvement
60–90 days
- governance
- tests
- documentation
- monitoring
The report should not end up in a folder: it must become a risk-reduction roadmap.
Technical audit vs organisational audit
What can an IT security audit cover?
A cybersecurity audit is not just a scan. The scope can combine several dimensions, according to your risks and priorities.
Technical
- systems
- servers
- workstations
- network
- cloud
- configurations
Organisational
- responsibilities
- procedures
- backups
- incidents
- access
- governance
Application
- websites
- applications
- APIs
Human
- accounts
- authorisations
- practices
- awareness
The scope is defined with you: technical, organisational, application or human audit, according to what is actually exposed.
The vulnerabilities we look for
What types of vulnerabilities can be identified?
The audit ranks gaps by nature and severity. It identifies what exposes the business, without being limited to an automated scan.
Misconfigurations
Ports, services, network rules, cloud…
Excessive rights
Administrator accounts or overly broad permissions.
Outdated systems
Insufficiently maintained components.
Application flaws
Depending on the web / app / API scope.
Unintentional exposure
Services or data accessible from the Internet.
Segmentation gaps
Insufficiently isolated environments.
Fragile backups
Lack of protection, restore not tested.
Insufficient incident processes
Organisation unable to respond quickly.
Example finding
What does a cybersecurity audit finding look like?
Each gap is written so leadership and IT can act on it: asset, severity, risk, recommendation, priority and owner.
Fictitious example
Asset: VPN server
- Finding
- Single-factor authentication used for several remote accounts.
- Severity
- High
- Priority
- Immediate
- Risk
- Compromise of remote access if credentials are stolen.
- Recommendation
- Deploy multi-factor authentication and review authorised accounts.
- Owner
- CIO / IT provider
Fictitious example intended to illustrate the structure of a finding. It does not describe any exploitation technique.
Vulnerability classification
How do we prioritise vulnerabilities?
Each gap is ranked so you know what to fix first. It is not a simple automated score.
Critical
Critical
Immediate correction.
High
High
Priority remediation.
Medium
Medium
Rapid planning.
Low
Low
Improvement or hardening.
The final priority takes into account the technical vulnerability, the actual exposure and the business impact.
Attack surface audit
What is your IT attack surface?
The attack surface covers the entry points an attacker could try to exploit to access your information system.
Internet-exposed services
Websites & web applications
VPN & remote access
User accounts
Cloud & SaaS services
Servers & network equipment
The audit starts by identifying what is actually exposed, before looking for vulnerabilities.
Mini diagnostic
Does your business show cyber risk signals?
Estimated cyber exposure
Maturity
55 / 100
Exposure
Moderate
Priorities
4
Recommended priorities
- audit exposed services
- review privileges
- test the incident plan
- analyse critical vulnerabilities
Recommended engagement
Complete cybersecurity audit
Assess my IT
Indicative diagnostic, not a substitute for a technical audit.
Audit ≠ pentest
Cybersecurity audit and pentest: what is the difference?
Cybersecurity audit
A global view:
- architecture
- configuration
- access rights
- procedures
- exposure
- systems security
- vulnerabilities
Pentest
A targeted offensive test to check whether certain vulnerabilities can actually be exploited.
An audit may recommend a pentest, but not every cybersecurity audit necessarily requires a full penetration test.
Do you specifically need a penetration test? See our pentest service
Web security audit
Can the audit include your website and applications?
Yes. Depending on the agreed scope, the analysis can cover internet-exposed assets: websites, applications, administration interfaces, APIs and related services. A website security review then sits inside the cybersecurity audit, not a penetration test.
For an in-depth offensive test, see our pentest service
Who is it for?
Who needs a cybersecurity audit?
Any business that stores data, uses connected tools or has remote access is exposed. An audit measures your actual risk level precisely.
SMEs & mid-market without a CISO
You have no dedicated security officer and don't know if your IT would withstand an attack. The SME cybersecurity audit gives a structured view without a full in-house security team.
Businesses that have never been audited
Without a first diagnostic, exposure, access and configurations remain assumptions. The audit sets a usable baseline, before you invest in tools or fixes.
Businesses after an incident
You suffered a cyberattack, phishing or data breach. A post-incident audit looks at how the event was made possible and how to reduce the risk of recurrence.
Organisations that have changed significantly
New cloud, ERP, application, merger, remote work: the IT environment is no longer the one previously considered acceptable. The audit updates the actual attack surface.
Businesses preparing for ISO 27001
The cybersecurity audit establishes current maturity and the gaps to treat, before starting an ISO 27001 programme.
Organisations facing client or regulatory requirements
Supplier questionnaires, security clauses, tenders or reviews: the audit provides findings and evidence you can use, so you can respond without improvising.
SME cybersecurity audit
Cybersecurity audit for SMEs: do you need a CISO first?
No. The point of an SME cybersecurity audit is precisely to give a smaller organisation a structured view of its risks without needing a full in-house cybersecurity team.
Know where to focus the budget
Put spend on the risks that actually matter, rather than on too many poorly suited tools.
Identify critical vulnerabilities
Spot the flaws to fix first, before they are exploited.
Challenge the IT provider
Get an independent view to question technical choices and the managed service provider’s priorities.
A readable roadmap for leadership
A prioritised action plan, understandable outside the IT team, to decide and follow up over time.
Post-incident audit
Have you already suffered an incident? The purpose of the audit changes
After a cyberattack, phishing or data breach, the audit is no longer only preventive. We look at how the incident was made possible, then harden the setup. This is not a forensic investigation.
We typically look at
- how the attack or incident was made possible
- which similar weaknesses remain
- which access rights need to be reviewed
- which measures need to be hardened
- how to reduce the risk of recurrence
The post-incident audit produces a prioritised remediation plan, not a judicial investigation report.
Our pricing
How much does a cybersecurity audit cost?
The price of a cybersecurity audit depends on your IT size, scope and test depth. A preventive audit costs on average 20 times less than a cyberattack. See what drives the price.
SME cybersecurity diagnostic
€2,500 – 4,900 excl. VAT
Micro-business / SME, IT < 50 workstations
- Technical systems audit
- Access and rights review
- Vulnerability report
- Prioritised action plan
- Oral debrief (1h)
Most popular
Complete cybersecurity audit
€5,500 – 9,900 excl. VAT
Structured SME, remote access, cloud
- Full IT audit (systems + access + tools)
- Attack surface mapping
- Security policy analysis
- Detailed vulnerability report
- Executive debrief + 1 month follow-up
In-depth audit + remediation
€7,500 – 14,000 excl. VAT+
Mid-market, complex IT, sensitive sector
- 360° cybersecurity audit
- 30 / 60 / 90-day roadmap
- Complete remediation plan + follow-up
- Critical fix implementation
- ISO 27001 preparation included
Indicative pricing — a tailored quote is provided within 24 hours based on your exact scope. What does the price depend on?
In-depth penetration tests are priced according to scope and are included only when they are explicitly listed in the proposal.
What drives the price
What factors determine the price of a cybersecurity audit?
The price of a cybersecurity audit is calculated from the actual scope — not a single flat fee. These elements also explain why the price of an IT security audit varies from one organisation to another, and are clarified in the first conversation.
Number of sites
Number of users
Number of servers
Cloud / on-premise infrastructure
Number of applications
Internet-exposed surface
Network complexity
Test depth
Whether a pentest is included
Number of interviews
Available documentation
Need for a re-audit
What is a cybersecurity audit?
A cybersecurity audit is a methodical analysis of your systems, access, configurations, practices and attack surface, to identify vulnerabilities and prioritise remediation. It results in a classified report and an action plan. See the definition.
What is the difference between a cybersecurity audit and an IT security audit?
In practice, both expressions largely cover the same intention. The precise scope — systems, applications, access, organisation — should mainly be defined before the engagement.
How do you carry out an IT security audit?
Carrying out an IT security audit follows an 8-step method: scoping, mapping, analysis, complementary tests depending on the scope, risk qualification, report, remediation plan, then debrief. See how it unfolds.
How much does a cybersecurity audit cost?
The price of a cybersecurity audit depends on the actual scope, not a single flat fee. As a guide: SME diagnostic €2,500–4,900 excl. VAT, complete audit €5,500–9,900 excl. VAT, in-depth audit + remediation €7,500–14,000 excl. VAT+. See the price factors and the packages.
How long does an audit take?
Duration depends on the scope. For a standard SME, allow 5 to 8 days of audit + 2 days for report and debrief. For more complex IT, the audit may take 3 to 4 weeks.
What is the difference between an audit and a pentest?
The audit provides a global view: architecture, configuration, access rights, procedures, exposure and vulnerabilities. The pentest is a targeted offensive test to check whether certain vulnerabilities can actually be exploited. See the difference.
Does an audit necessarily include a penetration test?
No. An audit may recommend a pentest, but it does not necessarily include one. In-depth penetration tests are priced according to scope and are included only when they are explicitly listed in the proposal. See pricing.
What is an attack surface?
The attack surface is the set of entry points an attacker could try to exploit to reach the information system: exposed services, remote access, applications, administration interfaces and related dependencies. See the attack surface.
Can you audit a website only?
Yes, depending on the agreed scope. The analysis can focus on a site, applications or exposed services. A web security audit then sits within the cybersecurity audit, not within a penetration test. See the web audit.
How often should you run a cybersecurity audit?
There is no universal frequency. It depends on the level of risk, on changes (cloud, ERP, merger, remote work, new applications) and on context (client requirements, incident, ISO 27001 preparation).
What does a cybersecurity audit report contain?
The report typically includes the map of the audited scope, the identified attack surface, the vulnerability list ranked by severity, an executive summary, the detailed technical report, the remediation plan and 30 / 60 / 90-day prioritisation. See the deliverables.
What happens after the audit?
A debrief meeting presents the findings to leadership and technical teams. The report becomes a 30 / 60 / 90-day roadmap. A re-audit after correction and remediation support can be included in the quote.
Does the audit lead to ISO 27001?
No. A cybersecurity audit can serve as a diagnostic or contribute to preparation, but it is not in itself an ISO 27001 certification. See ISO 27001 support.
Does an SME need a cybersecurity audit?
Yes, if the question is one of risk management. There is no need to wait until you have a large IT department or a dedicated CISO. See the SME cybersecurity audit.
Ready to discover your vulnerabilities before an attacker does?
Our experts analyse your IT and deliver a complete vulnerability report within 5 days. First conversation free, confidential, no commitment.
Start my cybersecurity audit
First conversation free
Total confidentiality
Report within 5 days