SMEs in the crosshairs
Small and medium-sized enterprises are specifically targeted - because attackers expect less resistance there. Many incidents go unnoticed for a long time, until the damage is already done.
SME Security Assessment
Know where you stand - and what to do next.
Our 360-degree security assessment shows you the true state of your IT security in 2-3 weeks - externally, internally and organisationally. Specifically designed for small and medium-sized enterprises.
DIN SPEC 27076 available From EUR 5,000 Funding eligible
Trusted by over 200 SMEs
- 200+
- Security assessments for SMEs
- 9 in 10
- Clients implement recommendations directly (AWARE7)
- 2-3
- Weeks from kickoff to results
- 24h
- Until individual quote
Threat Landscape
Why SMEs are particularly at risk
SMEs are attractive targets - because attackers know that budget and personnel for IT security are often limited there.
Existential follow-on costs
Business interruption, data recovery, legal costs and reputational damage can add up quickly. For an SME, a single incident can threaten the existence of the business.
NIS-2 in force since Dec. 2025
The NIS-2 transposition law in Germany has been in force since 06.12.2025 and massively expands the circle of regulated organisations. Many SMEs are also affected - with personal liability for company directors.
Three Components
External + Internal + Workshop = Complete Picture
Our SME Security Assessment combines three components into a cost-effective package. Each valuable on its own, unbeatable together.
External Analysis - The Attacker's Perspective
What does your organisation look like to an attacker? We check all externally reachable systems and services:
- Web presence & web applications
- Mail security (SPF, DKIM, DMARC)
- DNS configuration & SSL/TLS
- Cloud services & external APIs
- Exposed services & ports
- Data breach check (OSINT)
Internal Analysis - Behind the Scenes
On-site or via VPN we review your internal infrastructure for the most common vulnerabilities:
- Active Directory & permissions
- Network segmentation
- Patch management & updates
- Backup & disaster recovery
- Endpoint security & antivirus
- Logging & monitoring
Workshop for Management & IT
IncludedHalf-day interactive workshop in which we present results clearly, identify quick wins and jointly develop a roadmap for the next 6-12 months:
- Management-ready results
- Live demo of selected vulnerabilities
- Prioritised action roadmap
- Optional: awareness demo (live hacking)
Funding eligible
CyberRiskCheck per DIN SPEC 27076
DIN SPEC 27076 was developed by the BSI (German Federal Office for Information Security) and the German SME Association - specifically for organisations with fewer than 50 employees. 27 requirements across 6 topic areas, completable in approx. 3 hours. Eligible for funding in several German federal states.
- NRW: MID-Digitale Sicherheit
- Up to 50% co-funding (EUR 4,000-15,000)
- 27 requirements
- Structured across 6 topic areas
- BSI-standardised
- Recognised assessment procedure
- ISO 27001 entry point
- Building on the check results
Your Contact Persons
Our consultants know the typical vulnerabilities in SMEs - and which measures have the greatest impact.
Managing Director of AWARE7 GmbH with many years of expertise in information security, penetration testing and IT risk management. Graduate of the Internet Security master's program at Westfälische Hochschule (if(is), Prof. Norbert Pohlmann). Bestselling author with Wiley-VCH and lecturer at the ASW-Akademie. His assessments of cybersecurity and digital sovereignty have appeared in Welt am Sonntag, WDR, Deutschlandfunk and Handelsblatt, among others.
IT-Grundschutz-Praktiker (TÜV) IT Risk Manager (DGI) § 8a BSIG Prüfverfahrenskompetenz Ausbilderprüfung (IHK) T.I.S.P. Board-Mitglied
M.Sc. in Internet Security (if(is), Westfälische Hochschule). COO and authorized officer (Prokurist) with expertise in information security consulting and security awareness. Junior professor (Nachwuchsprofessur) for Cyber Security at FOM Hochschule, CISO lecturer at isits AG and doctoral candidate at the Graduierteninstitut NRW.
ISO 27001 Lead Auditor (PECB/TÜV) T.I.S.P. (TeleTrusT) ITIL 4 (PeopleCert) BSI IT-Grundschutz-Praktiker (DGI) Ext. ISB (TÜV) BSI CyberRisikoCheck CEH (EC-Council)
How it works
From Enquiry to Results in 5 Steps
StepPhaseWhat happens
- 01
Kickoff & Scope
Personal meeting to capture your IT landscape, business processes and security requirements. We understand your organisation before we assess it.
- 02
External Analysis
Review of your externally reachable systems: web presence, mail security (SPF, DKIM, DMARC), DNS configuration, SSL/TLS and cloud services. What does an attacker see from outside?
- 03
Internal Analysis
On-site or remote review of your internal IT: Active Directory, network segmentation, patch management, backup strategy, endpoint security and access controls.
- 04
Workshop
Interactive workshop with management and IT leads. Understand results, identify quick wins, develop a roadmap. Optionally with a live hacking demonstration.
- 05
Final Report
Management-ready report with traffic-light ratings, a prioritised action plan and a realistic roadmap for the next 6-12 months.
Comparison
SME Assessment vs. Pentest vs. CyberRiskCheck
Three approaches to IT security - each has its place. The SME Assessment combines the best of both worlds.
| CyberRiskCheck | Penetration Test | SME Assessment | |
|---|---|---|---|
| Focus | Organisational | Technical depth | Technical + Organisational |
| Duration | 3 hours | 5-15 days | 2-3 weeks |
| Workshop included | No | Optional | Yes, always |
| Roadmap | Recommendations | Vulnerability list | 6-12 month action plan |
| Ideal for | Entry point (<50 employees) | Specific systems | Full overview (20-500 employees) |
| Funding eligible | Yes (DIN SPEC) | No | Yes (as CyberRiskCheck) |
References
SME References
These case studies are available in German.
Next Steps
After the Assessment: Targeted Hardening
The security assessment shows where you stand. These services help close the identified gaps:
ISO/IEC 27001 certified · BSI qualified · DIN SPEC 27076 qualified · AZAV accredited training provider
Why organisations trust AWARE7
What sets us apart from other providers
Pure awareness platforms don't test systems. Pure consulting firms are too far removed. AWARE7 combines both: we hack your infrastructure and train your employees: tailored to mid-sized companies, personal, without enterprise overhead.
Research and teaching as our foundation
20 %Around 20% of our revenue comes from research projects for the BSI and the BMBF. Our studies, published at ACM and Springer conferences, analyse millions of websites and tens of thousands of phishing emails. Three of our executives are professors at German universities at the same time.
Digital sovereignty: no compromises
100 %From first contact to final report, your data is stored on our own servers in Germany - no US cloud providers, no third-country transfers. Our AI also runs on our own hardware in Germany - with locally operated open-source models. Client and project data never reach external AI services. All staff are permanently employed, covered by social insurance and bound by uniform legal obligations.
More on digital sovereigntyFixed price within 24h: predictable project timelines
24 hWithin 24 hours you receive a binding fixed-price quote without hourly rate risk. A well-practised team and standardised processes ensure a clear schedule with a defined start and end date.
Your dedicated contact
1:1A personal project manager accompanies you from the first meeting to the retest. You book appointments directly with your contact person and keep the same contact throughout the project.
Peer-reviewed publications
Different Seas, Different Phishes - Large-Scale Analysis of Phishing Simulations
ACM AsiaCCS 2025
Oskar Braun, Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
A Platform for Physiological and Behavioral Security
NSPW 2025
Jan Hörnemann
Privacy from 5 PM to 6 AM: Tracking and Transparency in the HbbTV Ecosystem
IEEE/IFIP DSN 2025
Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
Understanding Regional Filter Lists: Efficacy and Impact
PoPETS 2025
Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
Who is AWARE7 the right partner for?
Mid-sized companies with 50-2,000 employees
Companies that need real security, without paying for a DAX-corporation provider. Fixed price, clear scope, one point of contact.
IT managers & CISOs
Who have to argue convincingly in-house and need a report in boardroom language for that, not just technical findings.
Regulated industries
Critical infrastructure, healthcare, financial services: NIS-2, ISO 27001, DORA. We know the requirements and deliver evidence that auditors accept.
Frequently Asked Questions
Your Questions About the SME Security Assessment
What is the SME Security Assessment?
The SME Security Assessment is a cost-effective comprehensive package for small and medium-sized enterprises. It combines an external and internal security review with a workshop for management and IT - covering technology, processes and awareness in one package. Unlike a pure penetration test, we also look at organisational and process-related aspects.
Which organisations is the assessment suitable for?
The assessment is aimed at SMEs with 20-500 employees who are looking for a structured entry point into IT security or who want to objectively assess their current status. Particularly relevant for organisations conducting a comprehensive security assessment for the first time, or preparing for NIS-2, DORA or an ISO 27001 certification.
What distinguishes the SME assessment from a penetration test?
The SME assessment is broader in scope: it looks not only at technical vulnerabilities, but also at processes, organisation and awareness. The penetration test focuses on technical depth in individual systems and actively attempts to exploit vulnerabilities. Ideally both measures complement each other - the SME assessment as an overall overview, the penetration test as a technical deep-dive.
How long does the assessment take?
The entire assessment typically takes 2-3 weeks. The external analysis requires 2-3 business days, the internal analysis 2-3 business days (on-site or remote), the workshop half a day. The final report is completed within 5 business days. For smaller infrastructures it can be faster.
What does the SME Security Assessment cost?
The SME Security Assessment starts from approx. EUR 5,000 for smaller infrastructures. The exact price depends on the size of your network and the desired scope. All three components (external, internal, workshop) are included in the package price. We provide an individual quote within 24 hours.
Is the assessment also available as a CyberRiskCheck per DIN SPEC 27076?
Yes. We also offer the assessment as a certified CyberRiskCheck based on DIN SPEC 27076. DIN SPEC 27076 was developed by the BSI together with the German SME Association and is specifically designed for organisations with fewer than 50 employees. The CyberRiskCheck is eligible for funding in several German federal states - in NRW for example through the MID-Digitale Sicherheit programme with up to 50% co-funding.
What does the workshop cover?
The workshop is aimed at management, IT leadership and the DPO if applicable. We present the results clearly with traffic-light ratings, demonstrate selected vulnerabilities live and jointly develop a prioritised action roadmap. On request we integrate a short live hacking demonstration for maximum awareness impact.
Can we conduct the assessment remotely?
The external analysis is always conducted remotely. The internal analysis can be carried out remotely via a secure VPN connection if required. We do however recommend at least an on-site appointment for the workshop - the personal interaction and live demonstrations have the strongest impact.
What happens after the assessment?
After the assessment you have a prioritised action plan. Many organisations implement quick wins immediately and commission us for the more complex measures: penetration testing, ISMS build-out, phishing simulation or security awareness training. We are happy to accompany you throughout the entire journey.
Aus dem Blog
Weiterführende Artikel
Weiterbildung & Zertifizierung
5 Gründe warum ein IT-Security E-Learning vor Cyberattacken schützt!
Ein IT-Security E-Learning kann in Unternehmen zum Schutz vor erfolgreichen Cyberattacken eingesetzt werden. Das sind die Gründe!
Jan Hörnemann Weiterlesen
Offensive Security
9 Hacking Gadgets 2025: Lernen und Forschen
Entdecke 9 Hacking Gadgets und erfahre, wie du sie sicher, legal und verantwortungsvoll nutzt, um IT-Sicherheit wirklich zu verstehen.
Vincent Heinen Weiterlesen
Security Awareness
8 WeTransfer-Alternativen vorgestellt!
WeTransfer speichert teils Daten auf Servern in den USA. Das birgt Risiken und ruft WeTransfer-Alternativen auf den Plan.
Chris Wojzechowski Weiterlesen
Ready to find out how secure your organisation really is?
Briefly describe your IT landscape - we will provide you with an individual quote within 24 hours. Free and non-binding.
Free · 30 minutes · No obligation
