We deal with packaged software as well as in-house applications. For packaged products the focus is on roles and integrations; custom builds add code and dependencies to the list.
Who may approve payments, edit master data or change prices in Business Central, BMD, SAP Business One or Odoo? We draw up a role model with the departments and implement it, including a four-eyes rule for sensitive actions.
Each integration gets its own technical account with exactly the rights it needs. Personal logins inside integrations are replaced before someone leaves and the marketplace connection quietly stops.
API keys, database passwords and certificates move out of config files and repositories into a vault such as Azure Key Vault or HashiCorp Vault. Leaked keys are rotated.
Single sign-on through Entra ID or Google wherever the application supports it, so multi-factor rules and the leaver process also cover the shop back office and the ticketing tool.
For custom software we add checks for known library vulnerabilities and static code analysis to the CI pipeline. WordPress and Shopware plugins are catalogued and kept up to date.
Changes to bank details, prices and user rights should be traceable. We enable the change logs the software already offers and forward them to a central store.
We begin with an overview of your applications and how they connect, because most problems hide in the hand-offs.
Which applications exist, who uses them, which integrations link them and under which accounts. Along the way we often turn up integrations nobody remembers.
Roles, accounts, keys and logs for each application. You receive a list of findings rated by urgency and effort.
A gradual move to dedicated service accounts, a vault and the role model, coordinated with your software partners so that no integration fails unnoticed.
A checklist for new applications and integrations plus automated pipeline checks, so the order survives the next project.
The most dangerous integration is the one nobody knows about. We regularly find links between shop, accounting and shipping software that run with full admin rights and were set up by a contractor no longer engaged. They carry on quietly until someone finds their credentials.
We coordinate directly with them, usually over video. They know the application; we bring the view of roles, accounts and integrations across the rest of your IT. Changes inside the application are normally made by the partner.
No. The key remains in the version history, and automated crawlers often find such keys within minutes. It must be revoked with the provider at once and a new one issued. After that we check the provider logs for misuse and clean up the history.
No. A penetration test attacks an application on purpose to uncover weaknesses. Application security is about ongoing hygiene: roles, accounts, keys and dependencies. The two complement each other; penetration testing sits in our software testing area.
Typically two or three workshops with the departments and a few days of implementation. The biggest effort is agreeing who genuinely needs what, not the technical settings.
Name your most important applications and integrations. We will tell you where we would look first.
Your enquiry has arrived
Our reply reaches you within one working day. Outages that leave your staff unable to work are dealt with first.
We could not find that town. Try another spelling, or choose whichever provincial capital lies closest; as everything is handled remotely, you get the same service in all nine Austrian states.
