Does This Sound Familiar?
Your IT provider secures your systems — but do they also test whether an attacker can still get in?
Your company processes customer data — but can you prove it is adequately protected?
CEO fraud, phishing, and ransomware are increasing — but do you know where your company is specifically vulnerable?
Our SME packages give you clear answers — without months-long projects and without technical expertise.
Our SME Packages
Fixed prices, clear scope, concrete result. All manual work — not just automated scans.
The clear security check for your SME. We test whether attackers can break into your systems from outside — manually, not by automated tools.
- ✓ External Penetration Test: Manual review of your publicly accessible systems
- ✓ Email Security Check: Can attackers send emails in your name? We check your SPF, DKIM, and DMARC configuration for gaps that enable spoofing and CEO fraud
- ✓ Darknet Exposure Check: Check for leaked passwords and credentials of your company
- ✓ Deliverables: Traffic light report for management + technical list for your IT provider + debrief meeting
The complete security review for SMEs that manage customer data or need to demonstrate compliance. Incl. revDSG compliance statement.
- ✓ Everything from the Basis package
- ✓ Web Application Pentest: Manual review of your core application for OWASP Top 10 vulnerabilities
- ✓ Microsoft 365 / Entra ID Pentest: How far does an attacker get in your Microsoft cloud with a compromised user account?
- ✓ Deliverables: Technical report + revDSG / nDSG compliance statement + debrief meeting
Add-on: Phishing Simulation. How do your employees respond to a targeted phishing email? A simulated campaign gives you hard numbers instead of guesswork. More on OSINT & Phishing
Typical Scenario
Fictional example, assembled from typical findings
A fiduciary firm. Microsoft 365. From one phishing click to the management's mailboxes.
Typical measures afterwards: restrict permissions on client folders, bring the service account under the MFA requirement, clean up app owners and secrets.
The starting point is a user account from the front office, as an attacker would take it over after a successful phishing email. The question: how far does that get them?
Key Findings
- Critical Via the «All employees» group, every client folder in SharePoint is readable — including accounting and tax records
- Critical A service account is exempt from the MFA requirement and owns an app with read access to all mailboxes. With a new client secret, the attacker reads the management's email
- High The password of this service account is stored in plain text in an IT document on SharePoint
How It Works
From the first call to the report: straightforward, on schedule, without disrupting operations.
Scoping Call
30 minutes, free of charge. We clarify together which package fits your company.
Testing
Manual testing by our specialists — without disrupting operations, during your business hours.
Report & Debrief
You receive your traffic light report and we discuss the results and next steps together.
Why Apesec?
No Outsourcing. No Junior Consultants.
Your tests are conducted by certified senior specialists. We do not subcontract and do not use entry-level consultants.
100% Switzerland. Discreet.
All tests are conducted in Switzerland. Your data does not leave Switzerland. We work under strictest confidentiality.
Certified Experts.
OSCP, CPTS and further international certifications. Our specialists are focused on offensive security — not checklists.