SAP Security · Cybersecurity reviews · Delft
Who can do what in your systems? Let's get that to 0 confusion.
We look at the evidence behind your access and security settings, tell you what it shows and what it doesn't, and agree the practical next step with your team.
OPEN QUESTIONS0
C06 · EMAILFictional example
DMARC policy is set to none
- Observation
- Record found, no enforcement.
- Limitation
- A DNS record alone doesn't show effective protection.
- Next step
- Review reports with your mail provider.
See what a report looks likeSample report
SAP Security & Authorizations
Role design, access reviews, segregation of duties and authorization governance.
Cybersecurity QuickScan
A scoped pilot review of your website, email and access evidence, checked by a person.
How we work
Discuss, agree, review, prioritise. Scope and price are agreed before work starts.
Where's the confusion?
Start with the question you can't answer yet
Turn the finding into a plan you can defend
We read the finding against your actual roles and users, separate what matters from what doesn't, and agree what to fix first.
Not every conflict needs the same fix
Some can be removed, some need the work split differently and some need a compensating control. We help you decide which is which.
A role design people can still explain
Role design and authorization governance, so that every new access request stops adding to the pile.
Decide what to migrate and what to redesign
Fiori changes how access works, so an old role concept rarely carries over as it is. The earlier this is on the plan, the better.
Website, mailbox, booking extranet, staff accounts
They all connect, and guests trust all of them. We review the evidence you supply and tell you what to ask your IT provider next.
Less noise. A clearer next step.
HTTPS, security headers, SPF and DMARC records, MFA settings: what the supplied evidence shows, and what it can't show.
What 0 means
Evidence first. Then a person. Then a next step.
Every engagement follows the same line, whether it's an SAP role or a DMARC record.
What does it actually show?
- Evidence agreed with you up front
- A clear scope and clear boundaries
- Unknown stays unknown, never a pass
A person checks every finding
Findings get a substantive human review before delivery. A disclosed version isn't proof of a vulnerability, and we won't say it is.
You know what to do on Monday
What to look at first, what remains unknown, and what to ask your team or IT provider.
SAP Security & Authorizations
SAP access you can explain to an auditor
Role design
Roles that follow how people work, not how the system grew.
Access reviews
Who has what, who approved it, and whether they still need it.
Segregation of duties
Conflicts ranked by risk, with a realistic way out for each.
Authorization governance
Clear ownership, so access stays clean after the project.
Could one person do both?
Segregation of duties means nobody can finish a risky job alone. Pick a task, and the others turn red or green.
Red: keep away from the same personGreen: usually fine
Click a coloured task to see why. Click the white one to start over.
Keep these apart
Add a new supplier + Pay the supplier
Pay a supplier you invented
One person could add a supplier that doesn't exist and send it money. Nobody else would need to touch it.
Three ways out
- Split it. Two people, two roles.
- Remove it. Often the access was never needed.
- Compensate. Can't split it? Add a check by someone else, and document it.
SOD CONFLICT · FK01 / BP + F110Illustrative examples. Your own ruleset decides what counts as a conflict.
Cybersecurity QuickScan · pilot
Your security settings shouldn't be a guessing game
Your website, email, accounts and booking providers connect your business. The QuickScan reviews the evidence you supply within an agreed scope, and a person checks the findings.
Website
HTTPS/TLS, security headers, cookies and configuration indicators, disclosed CMS and software.
Domain & email
Supplied DNS records, a bounded SPF and DMARC assessment, supplied DKIM selector information.
Access
Supplied account, MFA and role-management configuration. No login attempts.
Privacy & dependencies
Notice indicators and the booking or ordering providers you declare.
SAMPLE REPORTFictional data
We'll tell you what we found. And what we don't know.
The review states what was assessed, what was found and what remains unknown. That's the difference between a clear finding and a comforting score.
- Not a penetration test
- No guarantee of protection
- An enquiry never starts a scan
- Unknown evidence is not a pass
How it works
Four steps, and nothing starts without your say-so
1Discuss
Tell us what you want to understand.
2Agree
Confirm scope, evidence requirements, price and any required permission.
3Review
We assess the supplied evidence and separate findings from unknowns.
4Prioritise
You receive reviewed conclusions, and we discuss the practical next steps.
The 30 years describe the team's experience, not the age of the company or a claim of penetration-testing experience.
FAQ
Good questions. Straight answers.
Is this a penetration test?
No. The pilot reviews supplied evidence within an agreed scope. It does not attack or test live systems.
Will sending an enquiry start a scan?
No. Contacting us does not trigger a website request, DNS lookup or security check. Any assessment needs a separately agreed scope and written permission from an authorised party.
Can you guarantee that we are secure?
No. The review states what was assessed, what was found and what remains unknown. Unknown evidence is not treated as a pass.
Do you need passwords or customer data?
No. Do not send passwords, API keys or customer records. Evidence requirements are agreed separately.
Can you work with our IT provider?
Yes. Findings and evidence questions can be discussed with your designated IT provider.
How much does it cost?
Scope, price and timing are agreed before work starts. Remediation and repeat reviews are not automatically included.
