Skip to content

Services, Wiki-Artikel, Blog-Beiträge und Glossar-Einträge durchsuchen

↑↓NavigierenEnterÖffnenESCSchließen

SME Security Assessment

Know where you stand -
and what to do next.

Our 360-degree security assessment shows you the true state of your IT security in 2-3 weeks - externally, internally and organisationally. Specifically designed for small and medium-sized enterprises.

Request Security Assessment View 3 Components
DIN SPEC 27076 available From EUR 5,000 Funding eligible
RESULT PREVIEW - TRAFFIC LIGHT RATING
!

Access Controls

No MFA, shared admin accounts

CRITICAL
!

Backup & Recovery

Backups exist, restore never tested

WARNING
!

Patch Management

OS updates applied, no third-party patches

WARNING
✓

Mail Security

SPF, DKIM and DMARC correctly configured

OK
✓

Network Segmentation

Servers, clients and guest Wi-Fi separated

OK
Overall score: 62/100 5 quick wins identified

Trusted by over 200 SMEs

Security assessments for SMEs
200+
Clients implement recommendations directly (AWARE7)
9 in 10
Weeks from kickoff to results
2-3
Until individual quote
24h

Why SMEs are particularly at risk

SMEs are attractive targets - because attackers know that budget and personnel for IT security are often limited there.

SMEs in the crosshairs

Small and medium-sized enterprises are specifically targeted - because attackers expect less resistance there. Many incidents go unnoticed for a long time, until the damage is already done.

Existential follow-on costs

Business interruption, data recovery, legal costs and reputational damage can add up quickly. For an SME, a single incident can threaten the existence of the business.

NIS-2 in force since Dec. 2025

The NIS-2 transposition law in Germany has been in force since 06.12.2025 and massively expands the circle of regulated organisations. Many SMEs are also affected - with personal liability for company directors.

Three Components

External + Internal + Workshop = Complete Picture

Our SME Security Assessment combines three components into a cost-effective package. Each valuable on its own, unbeatable together.

1

External Analysis - The Attacker's Perspective

What does your organisation look like to an attacker? We check all externally reachable systems and services:

Web presence & web applications
Mail security (SPF, DKIM, DMARC)
DNS configuration & SSL/TLS
Cloud services & external APIs
Exposed services & ports
Data breach check (OSINT)
2

Internal Analysis - Behind the Scenes

On-site or via VPN we review your internal infrastructure for the most common vulnerabilities:

Active Directory & permissions
Network segmentation
Patch management & updates
Backup & disaster recovery
Endpoint security & antivirus
Logging & monitoring
3

Workshop for Management & IT

Included

Half-day interactive workshop in which we present results clearly, identify quick wins and jointly develop a roadmap for the next 6-12 months:

Management-ready results
Live demo of selected vulnerabilities
Prioritised action roadmap
Optional: awareness demo (live hacking)

Funding eligible

CyberRiskCheck per DIN SPEC 27076

DIN SPEC 27076 was developed by the BSI (German Federal Office for Information Security) and the German SME Association - specifically for organisations with fewer than 50 employees. 27 requirements across 6 topic areas, completable in approx. 3 hours. Eligible for funding in several German federal states.

NRW: MID-Digitale Sicherheit

Up to 50% co-funding (EUR 4,000-15,000)

27 requirements

Structured across 6 topic areas

BSI-standardised

Recognised assessment procedure

ISO 27001 entry point

Building on the check results

More about CyberRiskCheck

Your Contact Persons

Our consultants know the typical vulnerabilities in SMEs - and which measures have the greatest impact.

Chris Wojzechowski
Chris Wojzechowski

Geschäftsführender Gesellschafter

E-Mail
PGP 465C26E1AF161AFA

Geschäftsführender Gesellschafter der AWARE7 GmbH mit langjähriger Expertise in Informationssicherheit, Penetrationstesting und IT-Risikomanagement. Absolvent des Masterstudiengangs Internet-Sicherheit an der Westfälischen Hochschule (if(is), Prof. Norbert Pohlmann). Bestseller-Autor im Wiley-VCH Verlag und Lehrbeauftragter der ASW-Akademie. Einschätzungen zu Cybersecurity und digitaler Souveränität erschienen u.a. in Welt am Sonntag, WDR, Deutschlandfunk und Handelsblatt.

IT-Grundschutz-Praktiker (TÜV) IT Risk Manager (DGI) § 8a BSIG Prüfverfahrenskompetenz Ausbilderprüfung (IHK)
Vollständiges Profil ansehen
Jan Hörnemann
Jan Hörnemann

Chief Operating Officer · Prokurist

E-Mail
PGP A3FD64BB96C888E2

M.Sc. Internet-Sicherheit (if(is), Westfälische Hochschule). COO und Prokurist mit Expertise in Informationssicherheitsberatung und Security Awareness. Nachwuchsprofessor für Cyber Security an der FOM Hochschule, CISO-Referent bei der isits AG und Promovend am Graduierteninstitut NRW.

ISO 27001 Lead Auditor (PECB/TÜV) T.I.S.P. (TeleTrusT) ITIL 4 (PeopleCert) BSI IT-Grundschutz-Praktiker (DGI) Ext. ISB (TÜV) BSI CyberRisikoCheck CEH (EC-Council)
Vollständiges Profil ansehen

How it works

From Enquiry to Results in 5 Steps

  1. Kickoff & Scope: Personal meeting to capture your IT landscape, business processes and security requirements. We understand your organisation before we assess it.
  2. External Analysis: Review of your externally reachable systems: web presence, mail security (SPF, DKIM, DMARC), DNS configuration, SSL/TLS and cloud services. What does an attacker see from outside?
  3. Internal Analysis: On-site or remote review of your internal IT: Active Directory, network segmentation, patch management, backup strategy, endpoint security and access controls.
  4. Workshop: Interactive workshop with management and IT leads. Understand results, identify quick wins, develop a roadmap. Optionally with a live hacking demonstration.
  5. Final Report: Management-ready report with traffic-light ratings, a prioritised action plan and a realistic roadmap for the next 6-12 months.

SME Assessment vs. Pentest vs. CyberRiskCheck

Three approaches to IT security - each has its place. The SME Assessment combines the best of both worlds.

CyberRiskCheck Penetration Test SME Assessment
Focus Organisational Technical depth Technical + Organisational
Duration 3 hours 5-15 days 2-3 weeks
Workshop included No Optional Yes, always
Roadmap Recommendations Vulnerability list 6-12 month action plan
Ideal for Entry point (<50 employees) Specific systems Full overview (20-500 employees)
Funding eligible Yes (DIN SPEC) No Yes (as CyberRiskCheck)

SME References

Pentesting & Schwachstellenscans

Sill Optics GmbH

Feststellung der Angriffsfläche bei Sill Optics GmbH

Managed Phishing Simulation

Windhoff Group

Durchführung einer Phishing-Simulation für die Windhoff Group

6

Monate Simulationsdauer

2

Simulationen alle X Monate

Next Steps

After the Assessment: Targeted Hardening

The security assessment shows where you stand. These services help close the identified gaps:

Penetration Testing

Technical deep-dive of the identified critical systems.

Details

Phishing Simulation

Test how well your employees recognise phishing.

Details

ISMS ISO 27001

From security assessment to certification - the logical next step.

Details
ISO/IEC 27001 certified
BSI qualified
DIN SPEC 27076 qualified
AZAV accredited training provider

Why organisations trust AWARE7

Was uns von anderen Anbietern unterscheidet

Reine Awareness-Plattformen testen keine Systeme. Reine Beratungskonzerne sind zu weit weg. AWARE7 verbindet beides: Wir hacken Ihre Infrastruktur und schulen Ihre Mitarbeiter - mittelstandsgerecht, persönlich, ohne Enterprise-Overhead.

Forschung und Lehre als Fundament

Rund 20% unseres Umsatzes stammen aus Forschungsprojekten für BSI und BMBF. Unsere Studien analysieren Millionen von Websites und Zehntausende Phishing-E-Mails - publiziert auf ACM- und Springer-Konferenzen. Drei unserer Führungskräfte sind gleichzeitig Professoren an deutschen Hochschulen.

Digitale Souveränität - keine Kompromisse

Alle Daten werden ausschließlich in Deutschland gespeichert und verarbeitet - ohne US-Cloud-Anbieter. Keine Freelancer, keine Subunternehmer in der Wertschöpfung. Alle Mitarbeiter sind sozialversicherungspflichtig angestellt und einheitlich rechtlich verpflichtet. Auf Anfrage VS-NfD-konform.

Festpreis in 24h - planbare Projektzeiträume

Innerhalb von 24 Stunden erhalten Sie ein verbindliches Festpreisangebot - kein Stundensatz-Risiko, keine Nachforderungen, keine Überraschungen. Durch eingespieltes Team und standardisierte Prozesse erhalten Sie einen klaren Zeitplan mit definiertem Starttermin und Endtermin.

Ihr fester Ansprechpartner - jederzeit erreichbar

Ein persönlicher Projektleiter begleitet Sie vom Erstgespräch bis zum Re-Test. Sie buchen Termine direkt bei Ihrem Ansprechpartner - keine Ticket-Systeme, kein Callcenter, kein Wechsel zwischen wechselnden Beratern. Kontinuität schafft Vertrauen.

Für wen sind wir der richtige Partner?

Mittelstand mit 50–2.000 MA

Unternehmen, die echte Security brauchen - ohne einen DAX-Konzern-Dienstleister zu bezahlen. Festpreis, klarer Scope, ein Ansprechpartner.

IT-Verantwortliche & CISOs

Die intern überzeugend argumentieren müssen - und dafür einen Bericht mit Vorstandssprache brauchen, nicht nur technische Findings.

Regulierte Branchen

KRITIS, Gesundheitswesen, Finanzdienstleister: NIS-2, ISO 27001, DORA - wir kennen die Anforderungen und liefern Nachweise, die Auditoren akzeptieren.

Mitwirkung an Industriestandards

LLM

OWASP · 2023

OWASP Top 10 for Large Language Models

Prof. Dr. Matteo Große-Kampmann als Contributor im Core-Team des international anerkannten OWASP LLM-Sicherheitsstandards.

BSI

BSI · Allianz für Cyber-Sicherheit

Management von Cyber-Risiken

Prof. Dr. Matteo Große-Kampmann als Mitwirkender des offiziellen BSI-Handbuchs für die Unternehmensleitung (dt. Version).

Frequently Asked Questions

Your Questions About the SME Security Assessment

The SME Security Assessment is a cost-effective comprehensive package for small and medium-sized enterprises. It combines an external and internal security review with a workshop for management and IT - covering technology, processes and awareness in one package. Unlike a pure penetration test, we also look at organisational and process-related aspects.
The assessment is aimed at SMEs with 20-500 employees who are looking for a structured entry point into IT security or who want to objectively assess their current status. Particularly relevant for organisations conducting a comprehensive security assessment for the first time, or preparing for NIS-2, DORA or an ISO 27001 certification.
The SME assessment is broader in scope: it looks not only at technical vulnerabilities, but also at processes, organisation and awareness. The penetration test focuses on technical depth in individual systems and actively attempts to exploit vulnerabilities. Ideally both measures complement each other - the SME assessment as an overall overview, the penetration test as a technical deep-dive.
The entire assessment typically takes 2-3 weeks. The external analysis requires 2-3 business days, the internal analysis 2-3 business days (on-site or remote), the workshop half a day. The final report is completed within 5 business days. For smaller infrastructures it can be faster.
The SME Security Assessment starts from approx. EUR 5,000 for smaller infrastructures. The exact price depends on the size of your network and the desired scope. All three components (external, internal, workshop) are included in the package price. We provide an individual quote within 24 hours.
Yes. We also offer the assessment as a certified CyberRiskCheck based on DIN SPEC 27076. DIN SPEC 27076 was developed by the BSI together with the German SME Association and is specifically designed for organisations with fewer than 50 employees. The CyberRiskCheck is eligible for funding in several German federal states - in NRW for example through the MID-Digitale Sicherheit programme with up to 50% co-funding.
The workshop is aimed at management, IT leadership and the DPO if applicable. We present the results clearly with traffic-light ratings, demonstrate selected vulnerabilities live and jointly develop a prioritised action roadmap. On request we integrate a short live hacking demonstration for maximum awareness impact.
The external analysis is always conducted remotely. The internal analysis can be carried out remotely via a secure VPN connection if required. We do however recommend at least an on-site appointment for the workshop - the personal interaction and live demonstrations have the strongest impact.
After the assessment you have a prioritised action plan. Many organisations implement quick wins immediately and commission us for the more complex measures: penetration testing, ISMS build-out, phishing simulation or security awareness training. We are happy to accompany you throughout the entire journey.

Aus dem Blog

Weiterführende Artikel

Ready to find out how secure your organisation really is?

Briefly describe your IT landscape - we will provide you with an individual quote within 24 hours. Free and non-binding.

Request Security Assessment

Kostenlos · 30 Minuten · Unverbindlich