01Find
We find what an attacker would find.
Exposed services, over-wide permissions, flat networks, backups nobody has restored. Every finding is reproducible and ranked by what it would cost you.
- Security assessment
- Vulnerability assessment
- Web and API pentest
- Adversary simulation
02Attack path
We show how far it goes.
One weakness is rarely fatal. Chained, they are. We trace the route from the entry point to production data, and prioritise by it.
03Fix
Then we close it.
The engineer who found the issue builds the fix: hardening, access control, segmentation, detection.
- Linux and infrastructure hardening
- IAM and access control
- Network segmentation
- Detection engineering and alert triage
- DevSecOps
04Handover
And hand it over, documented.
Configuration, scripts and audit evidence are yours, documented so your own team can run them. The remediation plan is ready for the auditor.
- Remediation plan
- Configuration and scripts
- Audit evidence
We help companies identify security weaknesses and actually fix them.
Assessment and remediation from one provider, for companies of 50–500 people: from the finding to a working fix.
- Penetration testing
- NIS2 and audit readiness
- Hardening and access control
- Network segmentation
- Alert automation
From €1,200 · fixed price · 2–3 days
No obligation, NDA as standard. Or email hello@profixsec.com
Our risk, not yours
On the first engagement: if your auditor rejects the remediation plan we write, we don't invoice it.
Where do we start?
Pick what hurts most. Every path starts with the same fixed-price assessment.
Your situation
The first engagement
Turnaround
2–3 working days
Price
From €1,200, fixed
- What we look at
- Architecture, access, logging, backup and network separation, against the framework that applies to you.
- What you get
- A prioritised plan with the fixing step next to every finding.
What follows is quoted separately. No obligation to continue.
Prices, in the order the work usually happens.
01Gap assessment and remediation planMost engagements start here
Every finding paired with the step that fixes it. NIS2, ISO 27001, DORA or SOC 2.
From €1,200 · fixed · 2–3 days
02Focused build
One control area taken to working, such as backups with a tested restore.
From €2,500 · fixed · 2 weeks
03Security systems, built
Access management, logging, backups, segmentation. Built on open source: you pay for engineering, not licences.
From €6,000 · in milestones
04SecOps automation
Alert triage, enrichment and evidence collection that runs itself.
Scoped per environment
05Continuous controls monitoring
Scheduled access reviews, drift detection, restore tests and audit evidence.
From €700 / month
Focus areas, each with its own page
Four steps. No obligation past the first.
01
Intro call
30 minutes, free. We check the fit and scope the assessment.
02
Assessment
2–3 days, fixed price. A written report plus a walkthrough call.
03
You decide
Continue or stop. Anything next is priced separately.
04
Implementation
In milestones, with a direct line to the engineer doing it.
The experience we build on: our founder's work.
BYDCyber Security Engineer, site-levelTaking a converged OT/IT manufacturing site through NIS2NIS2OT / IT convergenceSegmentationZero TrustGRCWhat he didA manufacturing site fell under EU NIS2 with production systems and corporate IT sharing the same network reality. Compliance ownership was split across IT, overseas InfoSec, EHS, HR and production, with external compliance partners involved, and no single technical strategy tying it together.
- Defined and executed the site-level cybersecurity strategy against NIS2 requirements
- Implemented network segmentation, Zero Trust architecture and vulnerability management across OT/IT converged systems
- Ran cross-functional security governance across five departments, including vendor and third-party risk management
- Coordinated secure network architecture with the telecom provider and managed external compliance partners
- Identified and remediated vulnerabilities on ICS/SCADA-adjacent systems using Wireshark and Nmap, reducing attack surface
ONE HungaryCyber Operations ExpertDetection engineering across a multi-vendor SIEM estateSIEMDetection engineeringMITRE ATT&CKLog pipelinesAutomationWhat he didA national telecom runs security operations across five SIEM and log platforms at once, plus an in-house platform. At carrier volume, the hard problems are not tooling but detection quality, log integrity and the manual effort of keeping both correct.
- Operates and tunes a multi-vendor stack: Splunk, Microsoft Sentinel, Wazuh, Elastic/ELK and IBM QRadar
- Writes and tunes detection alerts in KQL and SPL, aligned to the MITRE ATT&CK framework
- Troubleshoots log transport pipelines (syslog-ng, nxlog) and LDAP/Active Directory authentication across enterprise Linux and Docker
- Builds internal security automation in Python and Bash, with Ansible for configuration management and runbook automation
- Applies AI-assisted log analysis to log quality and throughput, feeding anomaly and threat detection
Kibit SolutionsMachine Learning EngineerSecuring an AI pipeline that handles confidential recordsAI securityPII handlingPrompt injectionSecrets managementGCPWhat he didProduction AI agents processed CVs, candidate data and financial documents, which meant sensitive personal and financial data flowing through LLM infrastructure at volume. The security questions were not theoretical: prompt injection, data leakage, and who can retrieve what.
- Built vector retrieval pipelines across 10,000+ documents with data minimization and access control for confidential records
- Implemented input validation and sanitization to mitigate prompt injection and data-leakage risk
- Deployed hardened LLM inference backends (FastAPI/Uvicorn) in Docker, shipped via GitHub Actions CI/CD on GCP
- Set up API authentication and secrets management for the inference layer
- Automated end-to-end document processing with NER and entity linking across PDF, DOCX, image and CSV inputs
PROFIX Security Engineering
Founded by a practising security engineer. Every project is run end to end by the engineer you scope it with.
Levente Lajkó works in security operations at a national telecom: SIEM engineering, detection tuning, log pipelines. Before that he took a multinational manufacturing site through NIS2 and secured production AI systems handling confidential records. Everything we build is documented and yours.
For consulting and audit firms
We take on the technical part of your engagements as a subcontractor: assessment, penetration testing and implementation.