Cybersecurity consulting
Plenty of companies have nothing in particular to test. They have a file server, Microsoft 365 accounts, some business software, and a vague sense of worry. This service is for them: we look at how you actually work, decide what to secure first, and I help you put it in place.
How it works
It starts with a consultation. Thirty minutes on video, free. Before any technical talk, I want to understand the business: what you do and how, who handles IT internally and with what skills, your providers, the outside services you depend on (payroll software, hosting, point of sale). Only then do we go one level down. Who has admin rights? What does your IT look like today? How are passwords and logins managed?
If it makes sense to go further, I spend one or two days going through your setup with you or your IT provider. You leave with a short, ranked list of priorities, a bit like a prescription: what is urgent, what can wait six months, and what is pointless in your case.
What happens next is up to you. Apply the list with your IT provider. Or have me come back a day or two a month and work through it together.
What we can work on
- Accounts and access
- MFA wherever possible, separate admin accounts, and staff departures that really close the doors.
- Microsoft 365 and Azure
- Default settings leave doors ajar: external sharing, legacy authentication, overly broad permissions. I teach Azure (AZ-305) to engineers, so this is home ground.
- New infrastructure
- New office, migration, remote work: we plan security with your IT provider before the install. Fixing it afterwards costs a lot more.
- Procedures
- An IT policy people actually read, an onboarding and offboarding checklist, and a one-page emergency plan for the day something happens.
- Backups
- Make sure one copy survives ransomware: offline or immutable, and above all tested. A backup you have never restored is a guess.
- Awareness
- A session with your staff on phishing and fake-supplier fraud, using examples that look like the emails you really get.
- External requirements
- Turn NIS2, ISO 27001 or a big customer’s security questionnaire into concrete actions, in an order that fits your budget.
Why a pentester
I have spent the last 7 years attacking companies, with their permission. The ways in I find most often are mundane: a reused password, a former employee’s account still active, a forgotten server that no longer gets updates.
My advice comes from what I see on engagements, and I will also tell you when spending can wait. A top-of-the-range firewall, for instance, may not be the priority if passwords look like “qwerty”, servers no longer get updates or every user is admin of their own machine.
Famous attacks, mundane ways in
The attacks that make the headlines rarely start with anything sophisticated. Five examples, documented by the companies themselves or by the authorities.
Supermarket fridges, France, 2026
Attackers take over refrigeration controllers in supermarkets, boxes reachable straight from the Internet. CERT-FR has not published the exact way in, but its instructions speak for themselves: take the boxes off the Internet, update their firmware, change the default passwords.
CERT-FR alert CERTFR-2026-ALE-012Equifax, 2017
A flaw in a web component, made public in March 2017 together with its fix. The internal alert went to an out-of-date mailing list, the scan missed it, and the complaint portal server never got patched. Unknown actors found it two days after the flaw was announced.
US GAO report, 2018Colonial Pipeline, 2021
An old VPN account nobody used any more, protected by a single password, with no MFA. The ransomware that followed forced the pipeline to shut down for several days.
CEO’s US Senate hearing (official transcript)Change Healthcare, 2024
Stolen credentials, used on a remote access portal that had no MFA. Nine days later, the ransomware was launched.
UnitedHealth CEO’s written testimony to the US SenateFrance Travail, 2024
Advisor accounts taken over through social engineering, authentication judged not robust enough, and access rights that were too broad. The French data protection authority fined it €5 million.
CNIL decision, January 2026
Closing each of these doors was cheap. You just had to know it was there.
Still have something to test?
A website, an extranet, remote access: as soon as something is exposed to the Internet, the External Discovery Audit is a good starting point. One day, €500 excl. VAT, fixed price, deducted if an audit follows. It gives an objective picture of what an attacker sees, and the consulting work builds on it.
Frequently asked questions
We have no IT staff. Is this for us?
Yes. I talk to management in plain language. If you have an IT provider, I work with them: they keep running your machines, I help with the security side.
Our budget is very tight. Where do we start?
In France, with MonAideCyber, the free ANSSI programme: a trained volunteer runs a first diagnostic of about an hour and a half with you and leaves you a few priority measures. I would rather tell you. If you want to go further afterwards, the consultation is still free.
Do you sell hardware or software?
No, and I take no commission from any vendor. When I recommend a tool, it is because it solves your problem. Quite often you already have it in your Microsoft 365 subscription.
How long does it last?
There is no set length. A small company can cover the essentials in a few days spread over several months. A company in scope of NIS2 usually needs two or three days a month over time. We discuss it during the consultation, with figures.
Planning a security audit?
Estimate your audit online in 2 minutes, or book a call. You leave with a duration and price range, no strings attached.
Get a quote