Bytesoft runs vulnerability assessments, penetration testing, system hardening, monitoring and incident response planning for businesses across Greece, from a base in Patras. We work as an independent assessor: we do not resell software licences, so a finding does not depend on what you buy.
Business cybersecurity is the set of technical and organisational measures that protect a company's systems, data and accounts from unauthorised access, tampering and loss of availability. In practice that means finding vulnerabilities, controlling access, monitoring events, keeping backups that restore, and holding a written response plan for the day something fails.
The methodology is designed by an engineer holding a PhD in Computer Science with published research in cybersecurity.
A vulnerability assessment records known weaknesses across servers, network, applications and accounts, ranked by severity with a specific remediation instruction for each finding.
The list is delivered in a form that drops straight into a ticket: where the finding appears, what becomes possible if it stays open, which role closes it. Every automated finding is verified by hand; anything unconfirmed is marked as probable.
Penetration testing is an authorised attempt to exploit specific targets, inside an agreed scope and time window, to show which weaknesses lead to real access to data or to privileges.
Written authorisation fixes addresses, domains, hours, exclusions, who can call a stop, and that a critical finding is reported the same day. Deliverable: a technical report with the path taken and evidence, a management summary without jargon, and a prioritised remediation plan.
A vulnerability assessment answers where known weaknesses exist; penetration testing answers which of them lead to an actual breach. The first gives breadth, the second gives proof of impact.
| Criterion | Vulnerability assessment | Penetration testing |
|---|---|---|
| Objective | Breadth: known weaknesses across the whole scope | Depth: proof that a weakness can be exploited |
| Rules | Scanning and manual verification, without exploitation | Written authorisation with scope, hours, exclusions, stop point |
| What it proves | That exposure to a known flaw or misconfiguration exists | That the exposure leads to data or to elevated privilege |
| Deliverable | Findings list with CVSS scores and remediation instructions | Report with attack path, evidence and remediation order |
| When it is enough | On a regular cycle, or after infrastructure changes | When a client or a tender asks for proof of impact |
CVSS assigns each vulnerability a number from 0.0 to 10.0 based on how it is exploited and what it affects, so two assessors reach comparable severity. The score shows severity, not risk to your company: a 9.8 on a test system can wait, a 6.5 on the invoicing server cannot.
| Level | Score | What it means | Remediation order |
|---|---|---|---|
| Critical | 9.0 – 10.0 | Exploitable from the internet without credentials, giving system control | 1 |
| High | 7.0 – 8.9 | Leads to access or privilege escalation, given some precondition | 2 |
| Medium | 4.0 – 6.9 | Limited impact, or needs chaining with another finding | 3 |
| Low | 0.1 – 3.9 | Small practical impact, usually information disclosure | 4 |
Hardening removes unnecessary exposure and sets what remains to a safer default: closing unused services and ports, removing stale accounts, correcting permissions, applying updates, encrypting the operating-system disk, turning on logging.
Every change enters a log with date, system, reason and how it is reversed. That change log is the deliverable, and it lets you reproduce the configuration on a new server or another provider.
We follow public standards so the assessment is repeatable and auditable by a third party, with every finding mapped to a specific point in them.
These standards are named as methods applied, not as a certification. Processes are aligned with ISO/IEC 27001 as a reference framework; alignment is not certification.
A re-test repeats the tests on findings declared fixed and confirms in writing which closed, which remain and which created new exposure. It keeps the original finding identifiers for line-by-line comparison. It is not a fresh full assessment: an infrastructure change or a new application reopens scope.
Article 32 of the GDPR requires technical and organisational measures proportionate to risk, and explicitly names pseudonymisation and encryption, confidentiality and integrity, the ability to restore after an incident, and regular testing of how effective those measures are.
That regular testing is where an assessment produces documentation: date, scope, findings, fixes, re-test. We do not judge whether you comply and we do not write legal opinions — that belongs to your legal counsel or your data protection officer.
Deadlines and content for breach notification under Articles 33 and 34 are described separately: breach notification and first actions.
The NIS2 directive extends cybersecurity obligations to more sectors and requires risk-management measures, management accountability, supply-chain security and reporting of significant incidents within defined deadlines.
The sectors it describes include energy, transport, banking, health, water and waste water, digital infrastructure, ICT service management, public administration, postal services, waste, chemicals, food and manufacturing.
ENISA, the European Union agency for cybersecurity, publishes related guidance; the reference is to public material, not a partnership. Whether you fall in scope is decided by your legal counsel. We handle the technical side.
A business of 5 to 50 people gains most from four things that are not bought as a product: a second factor on every administrator account, updates that are actually applied, backups tested by restoring them, and access removed on the day someone leaves.
What can wait: a SIEM billed by volume that nobody has time to read, a second antivirus layered on the first, a leak-monitoring subscription with no password-change procedure, firewall hardware beyond what your team maintains.
The technical foundations (updates, access, backups) are covered by IT support.
Bytesoft earns no revenue from reselling security licences and does not tie the assessment to a monthly retention subscription; you pay for the assessment and the report, not for what gets proposed afterwards.
When the assessor resells licences, the recommendation tends to end in a product. When the engagement is a retainer, the know-how stays with the provider. We hand over a report, instructions and a change log that your own team executes and keeps.
What you can check before you sign: the report names the standard behind every finding, the instructions can be executed by your own team or provider, and the hardening change log stays yours.
The threats are few in type and repetitive in method. For each one: how it arrives, what we look at during an assessment, what reduces the risk.
If the suspicion concerns something happening right now, the priority is containment rather than assessment: first-hours guide for an active security incident.
EDR records behaviour on workstations and servers and allows a device to be isolated; MDR is the same telemetry with a third-party team watching and responding; XDR correlates signals from devices, identity, email and network. The difference is who is watching and how many sources are connected, not the product brand.
The table explains the terms you will hear in proposals. It is not a price list: the scope of your project is set in discovery.
| Group | Term | What it means in practice |
|---|---|---|
| Endpoint | Antivirus | Detection of known malicious software by signature, not by behaviour. |
| Endpoint | EDR | Per-device action recording, alerting on a suspicious sequence, device isolation. |
| Endpoint | MDR | The same telemetry, with a third-party team watching it and acting. |
| Endpoint | XDR | Signals from devices, identity, email and network correlated into one chain. |
| Endpoint | Device encryption | Operating-system disk encryption; a stolen laptop without access to the files. |
| Endpoint | Patch management | Scheduled updates, with a record of what was left behind and why. |
| Identity | MFA / 2FA | A second factor, so a stolen password is not enough to sign in. |
| Identity | Password policy | Length and uniqueness rules, verified against what the systems actually enforce. |
| Identity | Password managers | An encrypted vault per team instead of passwords in sheets and chats. |
| Identity | Access control | Role-based rights with periodic review: who holds what, and why. |
| Identity | Employee offboarding | Accounts, devices, keys and forwarding rules removed on the same day. |
| Email security | Domain authentication, so a third party cannot send messages as you. | |
| Spam filtering | Bulk and suspicious mail rejected, with a quarantine queue somebody reviews. | |
| Anti-phishing | Link and attachment inspection, external-sender marking inside the inbox. | |
| Phishing simulation | Test messages with measurement and training, without naming individual staff. | |
| Staff training | Short sessions: recognising fraud, payment requests, how to report. | |
| Network | Firewall management | Documented rules: what is allowed, from where, why, when reviewed. |
| Network | Segmentation | Network zones, so one compromised workstation cannot see every server. |
| Network | VPN | An encrypted tunnel into the internal network, authenticated per user. |
| Network | Secure remote access | Administration without exposed ports, with a second factor and session logging. |
| Network | Zero Trust principles | No trust from network location; authentication and least privilege instead. |
| Cloud | Microsoft 365 security | A review of your company account: MFA, forwarding, third-party apps, audit logs. |
| Cloud | Google Workspace security | The same review in your domain: MFA, external apps, admin history. |
| Cloud | Sharing configuration | Who sees what in shared drives and public links, with expiry. |
| Monitoring | Vulnerability scanning | Repeated scanning on an agreed cycle, compared with the previous picture. |
| Monitoring | Credential leak monitoring | A check of whether company addresses appear in known published leaks. |
| Monitoring | Logs and alerts | Log collection and alerts a named person has agreed to read. |
| Response | Account compromise | Sessions ended, password changed, forwarding checked, exposure recorded. |
| Response | Ransomware recovery planning | Which systems return first, from which backup, and who decides. |
| Response | Incident response | Roles, order of actions and contacts through to a written close. |
| Governance | Security policies | Written rules for passwords, devices, access and reporting of events. |
| Governance | Documentation | Systems, suppliers, data and changes recorded for the next assessment. |
| Governance | Backup management | What is captured, how often, where it is held, who can delete it. |
| Governance | Restore testing | A real restore with the time measured; otherwise the backup does not count. |
A cybersecurity policy defines who has access to what, how passwords and devices are managed, what is permitted on personal equipment, how a suspicious event is reported and who decides during an incident. It also carries data classification, supplier rules, backup policy, the joiner and leaver procedure, and a review date with a named role.
The twelve points below are the baseline we check first, from the most commonly missing to the most specialised.
An engagement runs in five stages, and each stage closes with a written deliverable.
We do not publish amounts without discovery: cost is driven by how many systems are in scope, by whether exploitation is requested or only an inventory, and by whether hardening and a re-test are included. The amount locks in writing before testing starts.
The amount is set after discovery and depends on how many systems are in scope, on whether exploitation is requested or only an inventory, and on whether a re-test is included. You receive a band and milestones in writing before testing starts.
An external-surface assessment for one environment finishes in a few days of execution after scoping. Penetration testing against a web application needs more milestones. The timeline locks at kickoff.
A vulnerability assessment records where known weaknesses exist across the whole scope without exploiting them. Penetration testing selects targets and proves which of them lead to data access or elevated privilege.
CVSS assigns each vulnerability a number from 0.0 to 10.0 based on how it is exploited and what it affects. It shows severity, not risk to you: remediation order depends on how critical the affected system is.
We stop and notify the agreed contact point the same day, with a description and an immediate containment measure. The rule is written into the authorisation before testing starts.
Not always as a first step. If a second factor, updates or tested backups are missing, a vulnerability assessment delivers more value at lower cost. A pentest earns its place when you run your own application holding customer data.
MDR stands for managed detection and response: telemetry from devices and servers is watched by a third-party team acting within an agreed framework. The difference from EDR is not the software but who reads the alerts.
Zero Trust is the principle that no access is trusted merely because it comes from inside the network. Every request is authenticated and rights are limited to the minimum. It is a design principle applied gradually, not a product.
It depends on what you protect. Antivirus recognises known malicious software; EDR records behaviour and catches sequences that use legitimate system tools. With customer data or remote access, that recording adds visibility.
A controlled send of test messages to your staff, with management approval, to measure response and follow it with short training. Results are reported in aggregate per department, without naming individuals.
The cycle is agreed in writing and tied to events: an infrastructure change, a new application, a move to another hosting provider, a significant change in the team. Between full assessments, repeated scanning keeps the picture current.
We do not sell software licences and we do not provide continuous monitoring outside a contract. We do not issue compliance certificates and we do not judge whether GDPR or NIS2 applies to you. We do not guarantee that no incident will occur: the assessment lowers the probability and documents what was done.
Integrations we design carry access control from the first version; they run on secure hosting, with day-to-day technical support for workstations and servers after the assessment.
For shops, see store admin security for an online shop. Background: what is changing in cybersecurity for Greek businesses and practical measures against breaches of company systems.
Last updated: 2026-09-08
Related services: integrations designed with access control · secure hosting