Protect data. Check files. Make software resilient.

First, we determine which information, applications and business processes need to be protected. From this we derive a manageable sequence, for example clarifying access and recovery, encrypting mobile devices and securing public file uploads. A penetration test is scheduled where its results enable concrete decisions. You receive a clearly scoped starting point with responsibilities and documented work results.

The two cover different situations. Disk encryption protects stored data on a powered-off or correctly locked storage medium within the scope of the respective solution. File encryption can enforce permissions across storage locations and transfer paths. Whether both make sense depends on device operation, collaboration, data paths and protection needs. An already logged-in, authorized user remains a separate security case.

We align the scope with the use case: from a modest corporate network to a project with classified information. For VS-NfD or NATO RESTRICTED, specific products, versions, conditions of use and the operating concept are reviewed. If an assignment requires security-cleared personnel, the required evidence and access must be clarified in advance on a project basis. Ü3 denotes a security clearance for people, not a level of encryption.

Before the start, we agree on a fixed amount and a specific, reproducibly provable security finding within a permitted test scope. If this agreed proof is not provided, the agreed success-based penetration test fee does not apply. The result criteria, preconditions and acceptance are set out in writing. Remediation, additional consulting or retests are charged only if ordered separately. A test without a matching finding is not a guarantee of complete security.

This is clarified before the architecture decision. Depending on the edition, MetaDefender can also be operated in your own environment. Data transfer, external analysis, telemetry and update paths must match the respective data class. An on-premises scanner alone does not yet make a transition between classified networks permissible. We therefore take into account the complete approval process and the responsible bodies.

An actionable finding describes preconditions, affected functions, reproduction steps, technical impact and a classification within the business process. We discuss with your team where the root cause should be fixed. If agreed, a retest verifies the specific correction. For AI applications, we additionally consider model variability, data sources and the permissions of connected tools.