Audit of vulnerabilities in your company's security system
Comprehensive security for your key business processes — our area of responsibility
A comprehensive audit of information and physical security allows you to identify weaknesses in your company's infrastructure, prevent cyberattacks, and reduce the risk of fines and reputational damage
Why is this important?
Risk triggers: cyberattacks, data leaks, industrial espionage, penalties for non-compliance with federal laws and standards.
70% of attacks occur due to internal vulnerabilities. Damage from cyberattacks in 2024 exceeded $180 billion
IT infrastructure and network analysis
Testing physical security systems
Software and database verification
Analysis of access policy and internal processes
Report with specific vulnerabilities and remediation plan
What is included in the audit
Cases
Client
Oil and gas holding company
Task
A large holding company reported a problem with regular phishing attempts targeting employees and suspicious connections to internal systems.
Our actions
☑️ We conducted an audit of the network infrastructure and internal traffic.
☑️ We identified weak segmentation of the corporate network—users in the office area had access to technological segments.
☑️ We checked the relevance of software patches and found that some servers had not been updated for over a year.
☑️ Testing of the access control system revealed a lack of centralized control over access to certain production areas.
☑️ We identified weak segmentation of the corporate network—users in the office area had access to technological segments.
☑️ We checked the relevance of software patches and found that some servers had not been updated for over a year.
☑️ Testing of the access control system revealed a lack of centralized control over access to certain production areas.
Result
Based on our report, the client implemented additional measures to differentiate rights, strengthened incident monitoring, and updated the protection system. The number of successful unauthorized access attempts decreased by more than 60%, which prevented emergency shutdowns and financial losses.
Client
Federal retail chain
Task
The company was preparing for an inspection by the Federal Technical and Export Control Service (FSTEC) and feared fines for non-compliance with Federal Laws 187 and 152. The risks were estimated at up to 10 million rubles.
Our actions
☑️ We checked the personal data processing infrastructure and found that some internal services weren't encrypted.
☑️ We conducted an access policy audit and discovered that former employees retained access to internal systems.
☑️ We identified vulnerabilities in the integration of the access control system with the server system — some of the logs were not recorded correctly.
☑️ We conducted an access policy audit and discovered that former employees retained access to internal systems.
☑️ We identified vulnerabilities in the integration of the access control system with the server system — some of the logs were not recorded correctly.
Result
We promptly proposed a plan to eliminate the violations, implemented solutions for data encryption and correct configuration of the access control system. The company passed the inspection without any comments and avoided a fine, preserving its reputation and customer trust.
Client
Production plant (automated process control system)
Task
The plant noticed regular attempts to connect to its technological systems and requested an audit.
Our actions
☑️ We tested the automated control system and discovered incorrectly configured VPN connections that could be used to access internal networks.
☑️ We checked the server logs and found over 200 suspicious login attempts from external IP addresses.
☑️ We analyzed the monitoring system—some of the logs were simply not being saved due to incorrect configuration.
☑️ We checked the server logs and found over 200 suspicious login attempts from external IP addresses.
☑️ We analyzed the monitoring system—some of the logs were simply not being saved due to incorrect configuration.
Result
After correcting the settings, introducing two-factor authentication, and correctly configuring logging, the company was able to completely block potential channels for industrial espionage.
As a result of the checks, the security of critical infrastructure was improved, which was confirmed by an internal audit of the customer's security service.
As a result of the checks, the security of critical infrastructure was improved, which was confirmed by an internal audit of the customer's security service.
Client
Financial company
Task
The organization was preparing for ISO/IEC 27001 international certification and requested a security audit.
Our actions
☑️ We conducted a penetration test of the corporate network and identified three critical vulnerabilities that could allow access to customer data.
☑️ We reviewed access management policies and found that some employees had more privileges than necessary.
☑️ We analyzed database operations and found that backup copies were missing on certain segments.
☑️ We reviewed access management policies and found that some employees had more privileges than necessary.
☑️ We analyzed database operations and found that backup copies were missing on certain segments.
Result
We prepared a report detailing specific vulnerabilities and a plan
for addressing them. After implementing the measures, the company successfully passed international certification, which strengthened
its market position and increased trust among partners and customers.
for addressing them. After implementing the measures, the company successfully passed international certification, which strengthened
its market position and increased trust among partners and customers.
Work process
Application
Preliminary
consultation
consultation
Conducting
an audit
an audit
Report
and action plan
and action plan
Get an audit
Frequently asked questions
The duration of the audit depends on the size of the enterprise, the number of systems, and the complexity of the infrastructure. On average, a basic audit takes 2 to 4 weeks. For large industrial enterprises and critical infrastructure facilities, the duration can be up to 6–8 weeks. We always agree on the schedule in advance so that the process does not interfere with the enterprise's operations.
The audit includes not only document analysis, but also practical testing of systems. We use testing methods, including simulation of real attacks (penetration tests, insider activity simulation, security system log analysis). This approach allows us to identify vulnerabilities that cannot be detected solely by checking documents.
Of course. Before starting work, we sign a non-disclosure agreement (NDA) that protects all data obtained during the audit. Information about vulnerabilities, internal processes, and infrastructure is strictly confidential and is used solely for the purpose of improving security.
Yes, we offer both comprehensive audits and audits of specific areas. For example, only IT infrastructure, networks, and software, or only physical security and access control systems. However, we recommend conducting a full audit, as vulnerabilities often arise at the intersection of different systems, and only a comprehensive approach can identify all risks.
We provide a detailed report and plan for eliminating vulnerabilities, and if necessary, we take responsibility for implementing the measures ourselves.
Yes, some of the work (e.g., log analysis and penetration testing) can be performed without our specialists visiting your premises.
Yes, we recommend conducting it at least once a year or when infrastructure changes.
Protect your business today —
tomorrow may be too late
tomorrow may be too late
OUR CONTACTS
+7 (812) 509 58 90
info@subcontractors.online
info@subcontractors.online
LLC “Kontraktors Online”
10 Mitrofanevskoye Highway,
Business Center “Troitskiy”,
Saint Petersburg, 198095, Russia
10 Mitrofanevskoye Highway,
Business Center “Troitskiy”,
Saint Petersburg, 198095, Russia
Write to us