Cybersecurity and penetration testing for businesses
We test your defences before a hacker does, then help you strengthen them. An attacker's perspective, clear explanations and a concrete action plan.
What we do
- 01
Penetration testing
Simulated attacks on your websites, apps and internet-facing access points to find the vulnerabilities that can really be exploited.
- 02
Security audit
Review of your configurations, passwords, backups and practices, with clear priorities.
- 03
Hardening
Fixing vulnerabilities, updating systems, securing accounts and communications.
- 04
Awareness training
Hands-on sessions that teach your team to spot phishing and the most common scams.
Our solutions in detail
Penetration testing
How a properly authorised penetration test works, what it reveals about your website or app, and what drives its cost.
LEARN MORESecurity audit and risk assessment
What a security audit and an IT risk assessment cover, what you receive at the end and how to move on to action.
LEARN MOREHardening and remediation
Fixing vulnerabilities, securing accounts, servers and websites, then checking: how a hardening and remediation engagement works.
LEARN MORE
Cybersecurity within the law: written authorisation and rules of engagement
In France, accessing or remaining in a computer system without permission is a criminal offence, even with good intentions. That is why we only work on systems for which we hold the prior written authorisation of the person responsible for them, and always in compliance with the law.
Before any engagement, we draw up the rules of engagement together: the document that sets out what we are allowed to do, where, when and how. At a minimum, it covers the following points.
- 01
Scope
The addresses, websites, applications or devices included, and anything explicitly excluded.
- 02
Signatory
Someone with the authority to approve testing on behalf of your organisation, plus the agreement of any third parties involved where needed, such as your hosting provider or the vendor of an online service.
- 03
Schedule
The dates and time windows for testing, chosen to keep disruption to your business to a minimum.
- 04
Emergency contacts
Who to call, on both sides, if a test reveals a critical flaw or triggers unexpected behaviour.
- 05
Confidentiality
How the information gathered is protected, stored and then deleted at the end of the engagement.
The most common cyber threats facing SMEs
Attacks on small organisations are rarely spectacular. Most of them exploit ordinary weaknesses that crop up from one business to the next.
- 01
Phishing
A fake email or text message imitating a supplier, a bank or a public service, designed to steal a password or get someone to click a malicious link.
- 02
Payment fraud
A message that appears to come from a manager or a supplier, asking for an urgent transfer or a change of bank details.
- 03
Ransomware
Malicious software that encrypts your files, making them unreadable, then demands a ransom to restore them. Isolated, tested backups greatly limit the damage.
- 04
Compromised accounts
A reused or weak password without two-factor authentication is enough to open a mailbox or an admin area.
- 05
Outdated software
A website, plug-in or network device left untouched for years often has known, publicly documented flaws.
Audit, penetration test or hardening: where should you start?
The three services complement each other, but they answer different questions. The right starting point depends on what you already know about your situation.
- 01
You have no clear picture
Start with a security audit and risk assessment. We review your tools, access rights and practices, then rank the risks by priority.
- 02
You run a website, online shop or app
A penetration test checks in practice whether an attacker could get round your protections, steal data or take over an account.
- 03
You already have a list of vulnerabilities
Go straight to hardening and remediation: we fix, configure and check that every fix holds.
A method grounded in recognised frameworks: OWASP and ANSSI
We do not work on instinct. Our checks are based on public, widely recognised frameworks, which makes our findings comparable and verifiable by another provider.
We do not claim any official qualification or certification. If your status or regulatory obligations require a provider qualified by ANSSI, the French national cybersecurity agency, we will tell you in our very first conversation.
- 01
OWASP
An international non-profit foundation that publishes reference material on web application security, including a list of the most common risks and a detailed testing guide.
- 02
ANSSI guidance
France's national cybersecurity agency publishes practical recommendations, such as its IT hygiene guide, which underpin our configuration audits and hardening plans.
- 03
GDPR
The EU General Data Protection Regulation requires appropriate security measures whenever you process personal data. Our recommendations help you document those measures.
A single point of contact in Haute-Corse, with results you can understand
KALLISTACK is a studio based in Bastia, founded by Alexandre Sciacca, a full-stack engineer with more than ten years of experience. Having built and maintained websites, applications and servers helps us understand where vulnerabilities appear and how to fix them without breaking what already works.
We work with SMEs, startups and public bodies, in Corsica and beyond. Tests on internet-facing services are carried out remotely; audits can take place on your premises when that helps. You have a single point of contact from scoping to final verification, a reply within 48 hours and a clear quote before you commit to anything.
Every engagement follows the same steps: understand your business and its constraints, design the test or audit plan, carry it out while checking every result, then support you through the fixes.
Who this service is for
SMEs, shops, practices and public bodies that handle sensitive data or depend on their digital tools. No IT department needed: we turn risks into actions anyone can understand.
How we work
- T-3
Understand
We listen to your goals, budget and timeline. A clear quote, no jargon.
- T-2
Design
We map out the solution and the mock-ups, which you approve before any development starts.
- T-1
Build
We develop and test. You follow progress at every step.
- T-0
Launch & support
Go-live, then hosting, maintenance and improvements over time.
Technologies and methods
- Penetration testing
- OWASP
- Configuration audit
- System hardening
- Awareness
Frequently asked questions
What is a penetration test?
A simulated attack, carried out with your consent and within an agreed scope, to uncover weaknesses in your systems before malicious people exploit them.
Are small businesses really targeted?
Yes: automated attacks hit every business regardless of size, and the smallest are often the least protected.
What do you deliver at the end of an audit?
A readable report that ranks vulnerabilities by risk, explains their consequences and details the fixes, with hands-on support if you wish.
Is it legal to have my own website security-tested?
Yes, provided the person authorising the tests has the authority to do so and any third parties involved are informed where necessary. If your site is hosted or managed by a provider, their terms may require them to be notified or even to give their consent. We check this with you before we start.
Will our day-to-day work be disrupted during the engagement?
Avoiding that is part of the plan. Tests are scheduled in agreed time windows, the most sensitive checks can be run on a test environment, and an emergency contact is named on each side so that any unexpected behaviour is dealt with immediately.
Do you only work in Corsica?
No. We are based in Bastia and also work with clients on the French mainland and further afield. Much of the work is done remotely, with regular video calls.