From FTP edits to an AI-managed pipeline in about a week
Two online stores, 42,000 products synced from 1C, and changes made directly on the live server. One week later, the owner was shipping changes by describing them to an AI agent.
Infrastructure security audit & hardening
Infrastructure security audit, with the fixes included
We look at your infrastructure the way an attacker and an auditor would, then fix what matters most. You get a prioritised report and pull requests, not just a PDF.
An infrastructure security audit is a hands-on review of your servers, cloud accounts, network exposure, access, secrets, backups and change process, followed by hardening of the most important findings. It is for fintechs, payment companies and growing businesses that need to answer auditors, banks or partners. It starts at €3,500 and usually takes 2–3 weeks.
Who it is for
- Fintechs, payment and crypto companies preparing for an audit, a bank partnership or due diligence
- ICT suppliers whose financial-sector clients send security questionnaires
- Growing companies whose infrastructure was built fast and never reviewed
- CTOs who inherited servers and cloud accounts nobody fully understands
Why now
- A banking partner, card scheme or enterprise client sent a security questionnaire you cannot answer with evidence
- NIS2 is being transposed across the EU, and in July 2026 the Commission referred Spain and three other states to the CJEU for being late, so national rules are coming
- From 11 Sep 2026 the Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities, so you need to know what you run
- Nobody can say who has SSH or cloud admin access today, or when backups were last restored
- You are raising money or being acquired, and technical due diligence is coming
What you get
- External exposure map: every open port, admin panel, forgotten subdomain and origin that bypasses your CDN/WAF
- Access review: SSH keys, cloud IAM, CI/CD tokens, deploy keys and VPN accounts, with who has what and why
- Secrets scan of repositories and servers, including Git history, with a rotation plan for anything exposed
- Backup and restore test: we restore a real backup and verify it, instead of trusting the job status
- Patch and configuration review of operating systems, web servers, databases and containers against a hardening baseline
- Logging and detection check: what is logged, where it goes, and whether anyone would notice an intrusion
- Prioritised findings report in plain language for management, with technical detail for engineers
- Hardening of the top findings as reviewed pull requests or Ansible/Terraform changes, within the agreed scope
How it works
Scope and access
We agree the systems in scope and get read-only access. Nothing changes during the review.
Review
External scan, access and secrets review, configuration checks and a real restore test.
Report
A prioritised list of findings, each with risk, evidence and the fix. We walk you through it on a call.
Harden
We fix the top findings through pull requests and re-test, so the report ends with proof that it is fixed.
What we actually check
A useful audit is not a 200-item checklist. We focus on the paths attackers really use and the evidence auditors really ask for:
- What is reachable from the internet, and whether it should be. Typical finds: phpMyAdmin or Grafana open to the world, a database port exposed “temporarily”, or a server origin that can be reached around the CDN/WAF.
- Who can get in. Old SSH keys of former staff, shared root accounts, cloud users without MFA, CI tokens with admin rights.
- What leaks. Passwords in Git history,
.envfiles or database dumps in the webroot, backups in a public bucket. - Whether you can recover. We restore a real backup and check it. A backup job that reports “success” is not the same as a backup you can restore.
- Whether changes are controlled. Can someone edit production by hand, and would anyone notice?
A sample finding
High: production database dump reachable over HTTP. A file named
backup.sqlwas in the website’s public folder and could be downloaded without logging in. It contained customer emails and password hashes. Fix: file removed to quarantine, web server configured to refuse.sql,.zipand.envfiles, credentials rotated, access logs checked for downloads.
Every finding is written like this: what it is, why it matters, the evidence, and the fix.
What we do not do
We do not certify anyone, and we do not sell you a tool. We implement and evidence technical controls, so your QSA, auditor or banking partner gets clear answers. If a finding needs a decision only you can make, such as a vendor change or a budget, the report says so plainly.
Related work
DevOps leadership for a payments fintech's PCI DSS-scope infrastructure
A European fintech processing payments, cards and crypto, with 20–50 people and a regulated core. We lead its DevOps over the long term: infrastructure as code, PCI DSS controls, payments connectivity and disaster recovery.
Questions clients ask
How much does an infrastructure security audit cost?
From €3,500 excluding VAT for a small, well-defined setup, such as a few servers or one cloud account. You get a fixed-scope quote before we start, so the price does not grow by the hour.
How long does a security audit take?
Usually 2–3 weeks: about a week of review, then the report and the hardening of the top findings. Urgent issues we find along the way are reported the same day.
Is this a penetration test?
Not in the narrow sense. A pentest tries to break in from outside. We review the infrastructure from the inside as well: access, secrets, backups, patching and change control. Many breaches come from those, and a pentest does not see them. If you also need a formal pentest, we can prepare you for it.
Will the audit break anything in production?
No. The review is read-only. Any fix is made later, through a pull request or a planned change you approve, with a backup and a way back.
Do you give us a certificate?
No. We are not a certification body. You get a report with evidence and fixed findings, which is what auditors, QSAs and banking partners usually ask to see.
We are a small company. Is this too much for us?
The smallest useful version covers your public exposure, access, secrets and backups. That is where most real incidents start, and it fits the starting price.
Find out what is exposed today
Tell us roughly what you run. We will suggest a scope and a fixed price, and tell you honestly if a smaller check is enough.