We look at your infrastructure the way we look at our own
Most cybersecurity analyses start with the frameworks. We start with you. A resilience analysis gives you a concrete picture of where you are, what is actually going on, and what to do about it within 90 days.
Certifications and jurisdiction
- ISO 27001Information security
- ISO 14001Environmental management
- Swedish ownershipOwned and operated in Sweden
Resilience analysis Module 1, Foundation sprint
Three weeks, six domains, one concrete 90-day plan. No frameworks for the sake of frameworks.
See the approachModule 1, Foundation sprint
Six domains, three weeks, a 90-day plan
Domains in focus
Plain language first, technical term in brackets. We go deep on what matters and on what we can verify.
What the outside world sees
External attack surface. DNS, MX records, exposed services, certificate hygiene, public IP allocations. Passive analysis only.
Your connection to the world
Transit and connectivity. Internet transit redundancy, BGP, fibre path diversity. Weaknesses in the network topology.
Identity and access
IAM. MFA coverage, privileged accounts, joiner-mover-leaver. Service accounts to managed identities.
Ability to recover
Recovery. Tested backup, documented RTO, scheduled quarterly restores of the top 3 systems.
The findings table
What the findings table looks like
Six representative findings from a typical Foundation sprint. Ranked by risk times effort. P1/P2 classification for priority, S/M/L for effort, indicative cost in the description.
- Priority · HighEffort · Medium
Single transit at the primary site
All external traffic goes through one ISP. The AS path has no redundancy. A 30-minute outage stops email, VPN and the customer-facing portal. Add secondary transit with an alternative carrier. Configure BGP failover. Indicative cost: approx. SEK 25k/month.
- Priority · HighEffort · Small
Backup not tested for 14 months
Backup jobs run and report green. Last verified full restore: 2025-02. Restore time unknown. Scheduled quarterly restores of the top 3 systems. Documented RTO. Indicative cost: approx. 8 hours of internal work.
- Priority · HighEffort · Small
MFA missing on 4 administrative accounts
Two service accounts and two privileged user accounts in Entra without enforced MFA. The accounts have global admin rights. Enforce MFA. Convert service accounts to managed identities. Indicative cost: approx. 4 hours of internal work.
- Priority · MediumEffort · Small
SPF and DKIM in place, DMARC is p=none
The email domain authenticates correctly, but DMARC is in a passive policy. Risk of spoofed customer communications. Move step by step from p=none to quarantine to reject over 60 days. Monitor the reports. Indicative cost: approx. 12 hours of internal work.
- Priority · MediumEffort · Large
Identity and email in the same jurisdiction
Entra ID and Microsoft 365 are both under US law. Customer contracts place growing demands on data localisation. A dependency map (Module 2) is recommended. Indicative 12-month migration window.
- Priority · LowEffort · Medium
No joiner-mover-leaver review
Manual offboarding routines, no automated checks. Risk of lingering access. Joiner, mover and leaver review. Automated deprovisioning in Entra with quarterly attestation.
Plan
The 90-day plan
The most important part of the document. If management reads only two pages, they read the summary and this one.
Bucket 1
This week
- Enable MFA on four administrative accounts (4 h)
- Remove three leftover accounts from offboarding (1 h)
- Schedule a restore test of customer-facing systems (planning)
Bucket 2
This month
- Run the restore test, measure RTO, document
- Start the DMARC move from p=none → quarantine
- Joiner, mover and leaver review in Entra ID
- Convert service accounts to managed identities
- Request quotes for secondary transit (2 to 3 carriers)
Bucket 3
This quarter
- Implement secondary transit and BGP failover
- Complete the DMARC reject policy
- Dependency map (Module 2), scope the identity migration window
- Make quarterly restore testing a routine
The journey
Build as far as it is worth it
Resilience analysis is a structured, modular journey. Every module has a fixed, clear scope. We build resilience at the pace and scale you want to invest in, from the first half-day to an ongoing resilience partnership. It has to work for both sides.
Situation overview
A half-day conversation, one page back within a working week.
1 page within 1 week
SEK 0 to 10k
Foundation sprint
Six-domain technical review, with a real restore.
2 to 3 weeks
SEK 60 to 120k
Dependency map
Dependencies, jurisdiction, sovereignty.
3 to 4 weeks
SEK 80 to 150k
Compliance
NIS2, CRA and GDPR, operational rather than legal.
4 to 6 weeks
SEK 150 to 300k
Resilience partner
An ongoing counterpart, on a monthly retainer.
Ongoing
SEK 15 to 40k/month
The final report in four parts
A one-page situation overview, with the most important points first. Written in plain language, with the technical term in brackets where needed.
Everything we found, ranked by risk times effort. P1 / P2 classification, effort in S / M / L, indicative cost per action.
Week, month, quarter. Who does what, when, and what it takes. Ready to act on, not a strategy document.
What the next step looks like if you want to go deeper. Dependency map, jurisdiction analysis, regulatory consequences: what is worth looking at in Module 2.
The document
This is what it looks like
One page, two at most. Delivered within 5 working days. Here is a representative extract.
Situation overview, Briefing
Resilience picture, Hagaby Industri AB
What we heard
Hagaby Industri makes specialised ventilation components and sells to the construction and property sector in the Nordics. It has around 140 employees across its head office and production in Småland and a distribution warehouse in Mälardalen. The business relies heavily on the ERP system IFS Cloud, which runs orders, invoicing and production planning. Backups run, but the last verified restore was done during the 2024 migration. The IT lead has been in the role since January 2026 and is mapping what they inherited.
The three biggest resilience risks
IFS Cloud and Microsoft 365 are both hosted by a US hyperscaler. When the supplier had disruptions in 2025, orders, invoicing and communication stopped at the same time. There is no out-of-band channel to customers.
IFS backups report green, but the last verified full restore was 19 months ago. RTO is undocumented. A backup that hasn't been tested doesn't exist.
Three PLC controllers have lost supplier support since 2024 and receive no security updates. They are on the same VLAN as the administrative clients, so a compromise on the office side reaches production.
What "good" looks like
You can handle a four-hour ERP outage without stopping packing or deliveries to customers. ERP restore is documented, rehearsed within 12 months and meets an RTO of eight hours at most. The production line sits on its own VLAN, with no direct access from the administrative network.
Recommended next step
We recommend a Foundation sprint, scoped to the three points above. Indicatively SEK 80k over three weeks. A detailed proposal is attached.
Ready to see your resilience?
A half-day situation overview, free of charge. We'll come back to you with one page within a working week.