A review of what is visible from outside
We check which services your connection shows the world and which of them should not be there. The result is a list ranked by urgency, not a hundred page report nobody will read.
Break-ins at companies rarely start with a sophisticated attack. They start with a remote desktop left open on a port, a router panel still on its factory password, or a VPN account belonging to someone who left two years ago. This page is about the edge of the network, meaning what the internet can see and who gets in from outside. What happens inside, the cabling, the switches and the company network with its Wi-Fi, we handle separately.
We usually start with one thing that costs nothing: we check from the outside what your company shows the world and put it on a list. Sometimes the list is empty and we say so plainly instead of selling a new firewall. More often it holds two or three items nobody in the company knew about, switched on once for a while during a single rollout.
Three things we find most often, and they look the same in every company. None of them took ill will, all of them came from haste.
The commonest way ransomware walks into a small company. Somebody once needed access from home, the port was opened for one evening and it is still open today. Automated scanners hit such ports constantly and try passwords, and the server reports this to nobody.
A camera recorder exposed so the owner can watch the shop floor from a phone very often still has its default password and firmware several years old. From that same segment of the network the file server is visible too, because the installer had no reason to separate them.
A VPN is the right direction, but when a password alone opens it, it leaks along with every employee password. Add to that the live accounts of people who no longer work here, because nobody had a line about revoking remote access on the leaver checklist.
One thing is worth understanding: these three items cost far less to fix than a new firewall and they take away the larger part of the risk. That is why we do them in this order. Replacing hardware is sometimes needed, but it is rarely the first step and it never substitutes for tidying up who has access. We apply the same principle beyond the network, across the whole order of security spending. The sharpest case for segmentation is a manufacturing plant, where one side holds machine controllers that must not be updated; we set it out under IT for manufacturers.
The amendment to the Polish national cybersecurity act, which brings in the EU NIS2 directive, came into force on 3 April 2026. For some companies that is a new duty, and for many others a new set of questions from their customers.
The official decision naming the covered organisations is gone and self-identification has taken its place. The rules cover eighteen sectors split into essential and important entities, so the duty can reach a company that never dealt with any of this before.
The application for entry in the KSC register has to be filed by 3 October 2026. The duties themselves, meaning an information security management system, incident handling and continuity of operation, fall due on 3 April 2027, and the first audit for essential entities on 3 April 2028.
Covered companies must account for the risk of their suppliers, so the requirements flow down to subcontractors. If you sell to a hospital, an energy utility or a large manufacturer, the questionnaire about your safeguards will reach you even when the act itself does not.
An honest caveat: we are not a law firm and we will not settle for you whether you are an essential entity, an important one or neither. That is a legal question and we treat it as one. What we do is the technical part that every auditor and every customer questionnaire asks about anyway: who has access from outside, what protects it, what gets recorded and how long it takes you to restore data after a failure. It is worth knowing the stakes have risen, because penalties now reach EUR 10 million or 2 per cent of turnover for essential entities, and liability extends to management. Healthcare is another sector named in the act outright, where the thresholds are counted differently and reach even a hospital's subcontractors, which we set out under IT for medical practices. The registration calendar, the difference between an essential and an important entity, and how the act differs from the DORA regulation are on the page about the KSC amendment.
Six things we start with. Each can be ordered on its own, but the order matters and it is usually this one.
We check which services your connection shows the world and which of them should not be there. The result is a list ranked by urgency, not a hundred page report nobody will read.
We match the device to the size of the company, set the rules and watch the subscriptions, because lapsed protection is a firewall with its lights on that no longer protects. Where the hardware is sensible we keep it rather than replace it.
We close the exposed ports and replace them with a tunnel and named accounts, so that an employee leaving means one click rather than changing a password everyone knew.
A password has stopped being enough for access from outside and for mail. We roll out confirmation by app or hardware key where the stakes are highest, which is the board and the accounts team.
The edge will not help when the threat arrives attached to an invoice. Protection for workstations and servers in one console gives what is missing most, a signal that something is happening before the first user rings.
Cameras, terminals and guests do not need to see the document server. Splitting into zones limits a break-in to one part of the company, and since that is work inside the network we describe it separately.
What we do not promise: that nobody will ever break in after our work. Nobody honest offers that guarantee. What we do promise is that the easy ways in will be closed, that you will see an attempt rather than hear about it from a customer, and that after the worst case there will be something to rebuild the company from, because we treat backups as part of the same puzzle.
Without a grand project at the start. First what is urgent and cheap, and only then the conversation about hardware.
We check what the internet can see and go through the list of accounts with remote access. It is one meeting, after which you know where you stand and can take that anywhere.
We switch off the exposed services nobody needs, revoke access for former staff and change factory passwords on the devices. That usually fits into a few hours of work and requires no purchases.
We set up a VPN with named accounts and login confirmation, tidy the firewall rules, and where the device no longer gets maker support we propose replacing it, with a price and a date.
Updates, expiring subscriptions and a review of who has access happen on a cycle, because the access list drifts in every company after a few months. This point goes into the retainer or stays with you if you have somebody to run it.
A shop floor with terminals, a clinic with patient records and a law firm with case files carry different risks and different requirements. See how it looks in your case.
The pages that connect with network security most often.
A provider router is usually enough to make the internet work, but it gives you no view of who comes in from outside and no way to split the network into zones. We start by checking what is visible through it and only then say whether it has to be replaced. Sometimes fixing the configuration of what already stands there is enough.
The first two steps, the review and closing what is urgent, usually fit into a few hours of work and need no purchases. The cost appears with the firewall and its subscription, and that depends on the number of people and the connection. We quote after the review, because without one it would be guesswork.
A company has to judge that for itself now, because the rules brought in self-identification instead of an official decision and they cover eighteen sectors. The legal assessment is not ours to make, the technical part is. Either way it is worth preparing, because the requirements flow down the supply chain and arrive in questionnaires from larger customers.
Through a tunnel with a named account for each person and login confirmed by a second factor, not through a port exposed to a remote desktop. Then an employee leaving is one click, and a leak of their password does not mean a way into the company. Setting it up usually takes one working day.
Usually not. What has to go is hardware that no longer receives updates from its maker, because that cannot be kept safe. The rest more often needs correct configuration and care than replacement, and we do not earn anything by talking you into the opposite.
We cut off the affected part of the network, preserve the evidence and restore data from backup, while working out how the threat got in so that it does not return the same way. That is why a tested backup is part of this service rather than a separate subject. Companies covered by the act have 24 hours for the first incident report.
Here we cover the edge, meaning the firewall, access from outside and what the internet can see. The company networks page covers the inside, meaning cabling, switches, Wi-Fi and the split into zones. In practice we often do both in the same project, but we describe them separately so you can order only what you need.
The first meeting takes 30 minutes and commits you to nothing. We will tell you straight whether we can help and what we would propose.
2019 - 2024 Interactive Workspace Ltd. - All rights reserved.