Scoping & contact
Discussion about your IT system, constraints, and timeline — validation of scope and legitimacy.
Certified Expert — Business Cybersecurity Audit
IT Security Audit
An IT security audit tells an SME or mid-cap company where its information system can be attacked and in what order to fix it: public exposure, websites and applications, external and internal network, exposed accounts and passwords, in black-box, grey-box, or white-box mode depending on the scope. Pentest Starter (1 site and its hosting, 3 to 5 days): €3,499 HT from catalog (€1,749.50 HT with current offer). Pentest Premium (up to 3 sites or applications and network infrastructure, 7 to 10 days): €7,999 HT from catalog (€4,799.40 HT with current offer), with a 6 to 12-month roadmap. Active Directory, cloud, and Red Team: by quote.
A clear and actionable diagnosis for your IT department, CISO, or management — before vendor audits or NIS2 deadlines.
- Cybersecurity expert since 2020 — SMEs, mid-cap companies, e-commerce, and industry
- IT scope, public exposure, Active Directory, cloud — depending on scope
- Prioritized reporting: risks, quick wins, and roadmap
- First consultation without obligation — OSCP, CISSP, OSEP certified contact
Request an IT security audit
The external analysis of your perimeter starts upon submission. An expert will contact you with initial findings — free, no obligation.
150+
audited companies
SINCE 2016
72 h
first response
INCIDENT RESPONSE
1 247
vulnerabilities reported
ALL AUDITS
Included
re-test after correction
ALL OFFERS
Why act now
Cybersecurity can't wait for your next board meeting
Without visibility into your IT system's status, fixes remain reactive. An IT security audit provides an objective snapshot — useful for NIS2, client audits, and budget prioritization.
- NIS2 and supply chain: many entities must demonstrate enhanced cyber governance.
- SME/Mid-market incident costs: often hundreds of thousands to millions of euros (losses, remediation, reputation).
- Vendor audit or cyber insurance: a structured diagnosis speeds up questionnaire responses.
- Quick wins identified early: reduce attack surface before a pentest or compromise.
This exchange does not replace a legal audit, ISO certification, or a full GDPR legal analysis.
Method
4 steps simple
From initial contact to reporting: a clear process to decide on next actions.
Analysis & investigations
Proportionate tests (exposure, configuration, cloud, AD as scoped).
Prioritized report
Findings grouped with scores, quick wins, and actionable recommendations.
Support
Debriefing with an expert — pentest, remediation, or governance if needed.
Deliverable Example
What does a professional audit look like?
Anonymized example: executive summary, consolidated score, and priorities for your IT department or integrator.
- Executive summary and risk score on one page
- Prioritized findings with concrete remediation paths
- Internally shareable document (IT Dept, CISO, Management)
What our clients say
We don't rate ourselves.
Reviews published on our Google listing by companies that have actually been audited. Verifiable, one by one.
GOOGLE
We hired White-Hat to conduct a cybersecurity audit of all our servers, and we are very satisfied with the quality of their work. Philippe demonstrated professionalism, responsiveness, and excellent communication skills throughout the entire process. The recommendations provided were clear, relevant, and immediately actionable to strengthen our security. We highly recommend their services.
GOOGLE
Excellent experience with White-Hat for a comprehensive security audit of our SaaS platform. The quality of service was truly outstanding: Philippe took the time to understand our application's architecture before starting the tests, which made all the difference to the relevance of the results. The report was detailed, with vulnerabilities categorized by criticality, concrete evidence of exploitability, and recommendations directly applicable by our technical team. The post-delivery follow-up to verify the patches was a real bonus. Professional, rigorous, and attentive: exactly what you need to secure a SaaS product.
GOOGLE
We hired White-Hat for a comprehensive audit/advanced penetration test on our website, and it's clearly the direct contact with Philippe that makes all the difference. No salesperson between us, no unnecessary jargon: we communicate directly with someone who understands our challenges and can clearly explain the vulnerabilities found. The report was precise, with concrete evidence and recommendations that we were able to implement quickly. A truly trustworthy relationship; I highly recommend them.
GOOGLE
Professional work. Thank you.
GOOGLE
We urgently contacted White Hat following a suspected compromise of several servers. The team was extremely responsive and addressed our request within minutes, with clear communication at every stage. Their vulnerability analysis was conducted very rigorously, resulting in a detailed report and concrete, easy-to-implement recommendations to strengthen our security. The investigation of the compromised servers allowed them to quickly identify the source of the attack and contain the incident without any major disruption to our services. Professional, knowledgeable, and readily available, I highly recommend this provider for any cybersecurity intervention, especially in emergency situations.
Scope
What does this audit involve?
What does an IT security audit cover?
Depending on the scope: public exposure (services, ports, TLS, headers), websites and applications (OWASP Top 10 and CVEs, APIs, business logic), external and internal network (segmentation, VPN, VLANs, databases), accounts and passwords exposed on the Dark Web. Each finding is classified by risk, with its remediation, in a summary readable by the IT department, CISO, and management.
What security audit for an SME or mid-market company?
For an SME with a main website or application, the Pentest Starter covers the site and its hosting. For a mid-market company or an SME with multiple applications and an internal network, the Pentest Premium covers up to 3 sites or applications and the network infrastructure. Beyond that (Active Directory, cloud, multiple geographic sites), the scope is defined during the scoping phase.
How long does the audit take?
3 to 5 days for a website and its hosting (Pentest Starter), 7 to 10 days for up to 3 sites or applications with network infrastructure (Pentest Premium). The report is delivered at the end of the analysis, during a debriefing session.
What's the difference with a pentest?
The audit provides a snapshot of risks and priorities. A pentest, or offensive security audit, simulates an attack to prove a vulnerability is exploitable: our audits include this controlled exploitation of critical vulnerabilities.
Black box, grey box, or white box audit: which to choose?
In black box, the auditor starts with no information, like an external attacker. In grey box, they receive a user account and test what a client or employee could do. In white box, they have access to the source code and architecture: this is the most comprehensive approach, like a code audit. Grey box is the most common compromise for an SME.
A client requires a vendor cyber audit: what should we do?
The audit report answers the security questions in vendor and cyber insurance questionnaires: tested scope, vulnerabilities found, corrections made, and roadmap. Inform us of your client's deadline during scoping: we will set the delivery date accordingly.
To go further :
- Website security audit: duration, deliverables, and price
- Dark Web exposure audit: check for data leaks
- White box audit: source code review
- Penetration testing (pentest) in companies: OWASP and PTES methodology, duration
The human behind the tool
About your contact
I am a cybersecurity consultant: I assist IT teams and management with audits, penetration testing, and hardening. My background is field-oriented (SMEs, mid-cap companies, e-commerce, industry) with a simple requirement: actionable findings, not jargon.
Why this profession: making real risks visible to help decide quickly — securing also means clarifying what matters for the business.
Expertise built since 2020 in various contexts; recognized certifications (OSCP, CISSP, OSEP) and continuous threat monitoring.
Pedagogy: translating technical details into business decisions (prioritization, budget, planning).
FAQ
Your frequent
Do you operate throughout France?
Yes: technical missions are mostly remote. On-site presence is possible upon quote for scoping or debriefing.
How much does an IT security audit cost?
Pentest Starter (1 site, 3 to 5 days): €3,499 excl. VAT from catalog (€1,749.50 excl. VAT with current offer). Pentest Premium (up to 3 sites or applications and network infrastructure, 7 to 10 days): €7,999 excl. VAT from catalog (€4,799.40 excl. VAT with current offer). Active Directory, cloud, and Red Team: upon quote. A detailed quote will be provided after scoping, before any billed mission.
Are my data confidential?
Yes. Contact details and deliverables are treated as client data. NDAs can be provided upon request.
Ready to see clearly?
IT security audit
The external analysis of your perimeter starts upon submission. An expert will contact you with initial findings — free, no obligation.