Businesses Private clients
Remote assistance Help
Paying as a business Bank transfer via SWIFT, or card Is this invoice genuinely ours? PDF, ebInterface and ZUGFeRD
Deutsch English
Send an enquiry
Services
Solutions
Pricing
Training
About Apply
Contact
Send an enquiry
Browse the catalogue: 80 services in 18 areas
Managed IT services Your IT team without the office desk: devices, logins and servers kept running from afar All-inclusive IT support One flat monthly price covering PCs, Microsoft 365 and your servers IT helpdesk Staff report an issue via mail, portal or a Teams chat and get screen-share help fast Service desk One front door for all requests, priorities tied to the SLA, a monthly summary for the boss Round-the-clock support Engineers on standby overnight, at weekends and over public holidays Start, Business and Premium plans Monthly care starting at €890 plus VAT
Service plans and SLAs Contractual reaction times of 4 hours, 1 hour or 15 minutes System administration Logins, virtual hosts, shared drives and infected machines, all fixed through an encrypted session IT infrastructure A candid stocktake, quicker machines and desktops streamed from the cloud Network and telephony Firewall and WLAN audited, connections watched, calls handled inside Microsoft Teams Cloud and hostingNew Servers, shop hosting, S3 storage and mailboxes hosted in Austria or elsewhere in the EU Backup and recovery Copies kept off the premises, separated from the company network, restored on a schedule to prove they work
GDPR and data protection Processing register, AVV contracts and safeguards aligned with GDPR and Austria's DSG Security policies and documentation Written house rules you can hand to an auditor or use for NIS2 groundwork Security solution roll-out We pick the product, install it and tune the rule set Infrastructure security Network zones, a cleaned-up rulebase and servers with nothing needlessly exposed Application security Reviewed code and deployments that stay free of new gaps Data loss prevention (DLP) Keeps sensitive files from leaving via mail attachments, flash drives or file shares Database security Tight rights, encrypted tables and an audit trail of every query Web application firewall (WAF) Bad traffic and bots stopped before reaching your site, Shopware store or API Access control and endpoint protection MFA, Intune policies and laptops you control centrally VPN and encryption Safe tunnels for home working and BitLocker on every notebook Vulnerability scans Regular scanning with fixes prioritised by severity Antivirus and EDR Malicious activity spotted, the compromised device quarantined immediately SOC monitoring Every alert reviewed by a human, clear-cut attacks contained automatically at night too System hardening Factory defaults locked down using CIS benchmarks and BSI recommendations Safe use of AI Ground rules for what may be typed into Copilot or ChatGPT
Websites and web applications 14 services spanning one-page sites to B2B portals, with SEO, care plans and post-hack repair E-commerce and integrations Webshop wired up to BMD or RZL, Amazon, eps and Austrian Post Custom software Line-of-business tools, apps and APIs that follow your processes, not the other way round Software testing and QA Defects and slowdowns caught while they are still cheap to fix
Artificial intelligenceNew Practical AI work, from spotting the right opportunity to staff training under the AI Act Data and analytics Tidy master records, a single reporting base and invoices read in automatically IT advisory and audit A second opinion on your IT plans and on how the pieces connect Online marketing Leads followed from the ad click to the signed offer, tracked in a CRM
Software and licensing Official subscriptions for IDEs, monitoring suites and sysadmin tools Training Instructor-led online sessions for teams or individuals
No idea which step comes first? We review your setup over a remote session and email you a prioritised action list Request a review
Browse all 13 solutions
NIS2 readiness Check whether you fall in scope, then set up risk handling, incident reporting and proof GDPR compliance Paperwork and technical controls in order well before the DSB comes knocking Remote and hybrid work Employees reach files and programs safely wherever they happen to be working Downtime prevention Proven backups, monitoring and an emergency playbook prepared in advance
Retail and e-commerce Shopware or WooCommerce joined up with marketplaces, eps and couriers Manufacturing ERP, servers and plant network monitored so the shop floor keeps running Medical practices and healthcare Ordination software, ELGA and e-card stable, with health data locked down Construction Plans, BIM files and AVA data synced to tablets on site Logistics and transport WMS, carrier links and dispatch that survives an outage
Small businesses A well-run Microsoft 365 and help on hand, no IT hire needed Mid-sized companies Infrastructure and security under a signed service agreement Large enterprises Assigned engineers, fast reaction and reporting to your CIO Multi-site companies Identical IT at every branch, administered from one place
Your case looks different? Describe it in a few lines, and we assemble only the pieces that matter to you Send an enquiry
About us The people behind Apply and our remote-only way of working Payment Invoices, electronic formats and due dates Contact Mailboxes, our web form, plus Teams or Meet calls
Service · Software testing and QA

Penetration testing

Picture a supplier offering its customers a B2B portal for downloading drawings, tracking orders and filing complaints. The portal has grown over the years, several contractors have worked on it, and each company sees only its own data. That, at least, is the intention. What if a customer bumps the order number in the address bar by one and receives a competitor's drawing? Authorisation flaws of this kind are among the most common and most damaging, and no automated scanner reliably spots them. A penetration test is a controlled attack commissioned in writing by the system owner. We work remotely within an agreed scope and time window, avoid anything destructive, and deliver a report showing what we found, how serious it is and how to fix it.

Send an enquiry Inclusions overview
Written consent
from the system owner up front
OWASP
WSTG and ASVS as the basis
Manual
logic and permission flaws
Retest
confirms the fixes

Everything this covers

We agree the scope together. For web applications and their surroundings, these are the usual focal points.

Settle the details with an engineer

Scope and test type

Black box with no prior knowledge, grey box with test accounts for each role, or white box with access to the code. For most applications we recommend grey box, as it finds the most for the same budget.

Permissions

Horizontal and vertical privilege escalation: can a customer see others' data, can a basic user reach admin functions, do disabled accounts still work?

Authentication and sessions

Password rules, second factor, password reset, session lifetime and single sign-on via Entra ID or ID Austria where used.

Inputs and uploads

Injection into database and operating system, cross-site scripting, crafted files and parameters that alter prices, quantities or customer numbers.

APIs and apps

Whether the API itself enforces who may do what, whether it limits request rates and whether the app stores secret keys on the device.

Surroundings

Reachable admin consoles, outdated components, missing security headers, open cloud storage and forgotten test systems.

Report and retest

Every finding with a CVSS score, evidence and a suggested fix, a management summary, and confirmation once issues are resolved.

Our working method

Nothing starts without signed authorisation. You receive our IP addresses beforehand so your team can recognise us in the logs.

01

Scoping and consent

Scope, test type, time window, emergency contacts and the owner's authorisation, plus the host's where systems are hosted externally.

02

Testing

Mapping the attack surface and manual probing with tools such as Burp Suite, with no denial of service and no changes to real data.

03

Report

Delivered encrypted to named recipients and walked through over video with developers and management.

04

Retest

Checking the fixes and issuing a final confirmation for your records.

A vulnerability scan is not a penetration test. Scanners find known holes in outdated software and missing settings, which is valuable. But they have no idea that customer A must never see customer B's data. Those logic errors are what make the difference, and only someone examining the application by hand, as an attacker would, will find them.

Frequently asked questions

Because attacking someone else's systems without permission is a criminal offence, however well meant. Consent must come from the real owner. If the system runs with a host or service provider, we obtain their agreement as well.

We steer clear of destructive techniques, but some residual risk comes with any test. That is why we prefer a test environment. On live systems we only work within the agreed window and with a current backup.

No. You receive a report covering scope, methodology and findings, and a confirmation after the retest. That normally satisfies customers, insurers and ISO 27001 auditors.

At least annually and after major changes, such as a new interface, a new login method or a move to the cloud. For essential and important entities under NIS2, it can be one element of the required risk management.

Like a master key. It explains how to get in. Keep the circle of recipients small and do not put it in widely shared folders until every finding has been fixed.

Related work in the same area

Open the full area page
Service Functional testing Methodical checks that your software calculates, stores and responds as specified Service Load and stress testing Measuring how much your system can take instead of discovering it on the day Service Test automation Automated tests that show within minutes of any change whether everything still works Service Usability and UX testing Discovering why people give up on your website or app

Let us test the security of your application

Describe the application, its user roles and who owns it. We will suggest scope, test type and a schedule.

Availability
Monday to Friday, 8:00-17:00 Austrian time (CET/CEST), reply within one working day
Meetings
By video on Microsoft Teams or Google Meet

We only use cookies that are technically required: to run the website and to remember the location you picked. There are no advertising or tracking cookies. Details are in the privacy notice.