Cybersecurity and penetration testing for businesses
We test your defences before a hacker does, then help you strengthen them. We look at you the way an attacker would, then hand over a plan you can follow.
What we do
- 01
Penetration testing
Simulated attacks on whatever you expose to the internet, to find the holes someone could really use.
- 02
Security audit
We check your settings, passwords and backups, then rank what needs doing.
- 03
Hardening
Then we fix what we found: patches, updates, locked-down accounts.
- 04
Awareness training
Hands-on sessions that teach your team to spot phishing and the most common scams.
Our solutions in detail
Penetration testing
How a properly authorised penetration test works, what it reveals about your website or app, and what drives its cost.
LEARN MORESecurity audit and risk assessment
What a security audit and an IT risk assessment cover, what you receive, and how to move on to action afterwards.
LEARN MOREHardening and remediation
Fix the flaws, lock down accounts and servers as well as websites, then check the work. How a hardening and remediation engagement unfolds.
LEARN MORE
Cybersecurity within a legal frame, with written authorisation and rules of engagement
In France, getting into a computer system without permission, or staying in one, is a criminal offence. Good intentions change nothing. So we only work on systems whose owner has given us written authorisation beforehand, and always within the law.
Before each engagement, we draw up the rules of engagement with you, a document that sets out what we are allowed to do, on which systems, at what time and in what way. At the very least it covers the points below.
- 01
Scope
The addresses, websites, applications or devices in question. And what is excluded, spelled out clearly.
- 02
Signatory
A person entitled to authorise the tests on behalf of your organisation. If a third party is involved, your hosting provider or the publisher of an online service for instance, their consent is obtained where needed.
- 03
Schedule
The dates and time windows for testing, chosen to get in the way of your business as little as possible.
- 04
Emergency contacts
Who to call, on each side, if a test turns up a critical flaw or a system behaves in an unexpected way.
- 05
Confidentiality
How the information gathered is protected during the engagement, how long it is kept, then how it is deleted at the end.
The most common IT threats facing an SME
Attacks on small organisations are rarely spectacular. Most of them exploit very ordinary weaknesses, the kind you find from one business to the next.
- 01
Phishing
A fake email or text message poses as a supplier, a bank or a government office. The aim is to get hold of a password, or to make you click a booby-trapped link.
- 02
Payment fraud
A message that appears to come from the boss or a regular supplier asks for an urgent payment, or announces a change of bank details.
- 03
Ransomware
Malicious software encrypts your files, in other words makes them unreadable, then demands a ransom to give them back. With isolated, tested backups, the damage stays far more contained.
- 04
Compromised accounts
A password that is too simple or already used elsewhere, no two-factor authentication, and the mailbox or admin area is wide open.
- 05
Outdated software
A website, a plugin or a piece of network kit forgotten for years often carries known flaws that are publicly documented.
Audit, penetration test or hardening, where should you start?
The three services complement each other. They do not answer the same question, though. The right starting point depends on what you already know about your situation.
- 01
You have no clear picture
Start with a security audit and a risk assessment. We go through your tools and your access rights, look at how you work, then rank the risks by priority.
- 02
You run a website, online shop or app
A penetration test checks, in practice, whether an attacker could get round your defences. To steal data, for example, or take over an account.
- 03
You already have a list of vulnerabilities
Go straight to hardening and remediation. We fix and configure, then check that every fix holds.
A method grounded in OWASP and ANSSI guidance
We do not work on gut feeling. Our checks rest on public frameworks that everyone in the field knows, so another provider can compare our findings and verify them.
We claim no official qualification or certification. If your status or regulatory obligations call for an ANSSI-qualified provider, we tell you at the first conversation.
- 01
OWASP
An international non-profit foundation. It publishes reference material on web application security, including a list of the most common risks and a very detailed testing guide.
- 02
ANSSI guidance
ANSSI, the French national cybersecurity agency, publishes practical recommendations such as its IT hygiene guide. Our configuration audits and hardening plans start from there.
- 03
GDPR
As soon as you process personal data, the European regulation requires appropriate security measures. Our recommendations help you document them.
A single contact in Haute-Corse, and results you can follow
KALLISTACK is a studio based in Bastia, founded by Alexandre Sciacca, a full-stack engineer with more than ten years of experience. When you have built websites and applications yourself, and kept servers running, you know where vulnerabilities tend to appear. You also know how to fix them without breaking what works.
We work with SMEs and startups as well as public bodies, in Corsica or further afield, and while tests on internet-facing services are run remotely, audits can take place on your premises when that helps. You deal with the same person throughout. A reply within 48h, a clear quote before you commit.
Every engagement follows the same path. We begin by understanding your business and its constraints, then we design the test or audit plan and carry it out while checking each result, before helping you through the fixes.
Who this service is for
Any organisation that holds sensitive data or would grind to a halt without its computers. You don't need an IT department. We translate each risk into something you can actually act on.
How we work
- T-3
Understand
We talk through your goals and budget. You get a quote you can actually read.
- T-2
Design
We map out the solution and the mock-ups, which you approve before any development starts.
- T-1
Build
We develop and test. You follow progress at every step.
- T-0
Launch & support
Go-live. After that we host it, fix it and keep improving it.
Technologies and methods
- Penetration testing
- OWASP
- Configuration audit
- System hardening
- Awareness
Frequently asked questions
What is a penetration test?
A simulated attack, carried out with your consent and within an agreed scope, to uncover weaknesses in your systems before malicious people exploit them.
Are small businesses really targeted?
Yes: automated attacks hit every business regardless of size, and the smallest are often the least protected.
What do you deliver at the end of an audit?
A readable report that ranks vulnerabilities by risk, explains their consequences and details the fixes, with hands-on support if you wish.
Is it legal to have my own website security-tested?
Yes, if the person authorising the tests has the power to do so, and if any third parties involved are told when necessary. A site hosted or managed by a provider may fall under their terms, which sometimes require you to inform them, or even get their consent. We check this with you before we start.
Will our day-to-day work be disrupted during the engagement?
Everything is set up to avoid it. Tests run in agreed time windows, and the most sensitive checks can go through a test environment. Each side also names an emergency contact who can react straight away if a system behaves unexpectedly.
Do you only work in Corsica?
No. We are based in Bastia, but we also work with clients on the French mainland and further afield. A good part of the work happens remotely, with regular video calls.