Security as a service, delivered by people
Security should be proactive, not reactive.
Black Fox Security tests, audits and hardens what you run, and prepares you for the auditors who come after us. Penetration testing, risk assessment, forensics and a compliance practice that covers the standards and laws your clients ask about.
Why, how, what
Why, how, what
01 / Our why
We believe that security should be proactive and not reactive.
02 / Our how
Experts who wear many hats and are stubborn as mules, ready to challenge your policies, your procedures and your systems.
03 / Our what
Auditing, testing, hardening and forensics that improve your company's security, from documents and controls to the configuration of every device.
Practices
Five practices, one team
We harden your current security or build it from the ground up: documents and controls, or the technical configuration of networks, endpoints, servers and applications.
- 015 servicesOffensive securityPenetration tests and assessments that simulate the attack vectors you actually face.Penetration TestingMobile App Security TestingIoT Security TestingRF and Wireless Testing
- 0217 servicesCompliance and certificationReadiness for the standards, attestations and regulations your clients and regulators ask about. Be prepared for the official auditors.ISO/IEC 27001ISO/IEC 27701ISO 22301ISO/IEC 42001
- 038 servicesGovernance and riskAudits, risk assessments, frameworks and policies that show where you stand and what to do next.Information security auditSecurity risk assessmentNIST Cybersecurity FrameworkCIS Controls
- 044 servicesManaged securityRecurring work that keeps your security and compliance from decaying between audits.Vulnerability managementSecurity hardeningAccess reviewsContinuous compliance
- 057 servicesAdvisory and responseA security lead when you need one, answers when something has happened, and training for the people who keep you safe.Virtual CISODigital forensics and incident responseSecurity awareness trainingCyber hygiene training
Standards and regulations
The frameworks your clients ask about
Each one has its own page: what it asks of you, what we do and where our role ends. Certificates and attestation reports are issued by independent bodies; we work with long-standing certification partners, so you go from preparation to the official certificate in one engagement.
- StandardISO/IEC 27001
- StandardISO/IEC 27701
- StandardISO 22301
- StandardISO/IEC 42001
- StandardISO/IEC 27017 and 27018
- AttestationSOC 2
- AttestationSOC 1
- StandardPCI DSS
- StandardTISAX
- StandardCyber Essentials
- FrameworkBSI IT-Grundschutz
- RegulationNIS2
- RegulationDORA
- RegulationGDPR
- RegulationEU Cyber Resilience Act
- RegulationEU AI Act
- RegulationHIPAA
- FrameworkNIST Cybersecurity Framework
- FrameworkCIS Controls
- FrameworkCOBIT
How we work
Organisation is half the work
Most of our projects follow the same baseline, from the first meeting to the closing feedback.
Discovery phase
1. Kickoff meeting
A meeting, online or in person, to get the high-level requirements, constraints and expectations for your project. We tell you more about us, past projects and our first thoughts on this one.
Offer phase
2. Business proposal
A detailed offer tailored to your project, with time and cost estimates and any other artefacts it needs, such as action items or KPIs.
Commitment phase
3. Work effort
We do our thing: tests, audits or whatever the project requires, within the time frame agreed in the requirements.
Report and delivery phase
4. Results handover
We present the outcome: recommendations, a business report with a risk assessment, a technical report with proofs of concept, or whatever goals we agreed on. With a meeting, or without one if you prefer.
Feedback phase
5. Project closing
We ask how the project went for you and, if needed, go back and clear things up before closing it.
Testing methodologies
Black, grey or white box. We adapt to your requirements.
No prior knowledge
Black box
Performed without any prior knowledge of the target infrastructure or application. It simulates a real attacker who has to make their way from the outside in, through the publicly available endpoints of a network or system.
User-level knowledge
Grey box
Combines the other two: we start with the knowledge of a basic user, or of a user with elevated privileges. A more focused effort that finishes faster, with the possibility that some paths an outsider would find stay untested.
Full access
White box
Also known as clear box or logic-driven testing. The most time-consuming of the three, because there is a lot of information to process. With access to everything, including source code, it gives the most comprehensive assessment of internal and external vulnerabilities.
Certificates
Verify a Black Fox certificate
When an engagement is complete we can issue a certificate of engagement. Anyone you show it to can check it here by its ID.
Contact
Tell us what keeps you up at night
Send a request to arrange an online or in-person meeting, so you can tell us about your project and we can introduce ourselves properly. It is the first step to solving a security problem, or to preventing one.
We can sign an NDA before the first meeting. E-mail it to us beforehand.
contact@blackfox-security.com
Secure your business now.
We harden what you have or build it from the ground up.