Cybersecurity
Finding the flaws before anyone else does.
We audit source code, test applications, APIs and infrastructure, and fix what we find. It is a new line of work at Datapoint, built on the experience of people who develop and maintain information systems and know where they tend to fail.
What we do
From the code to the infrastructure, until the flaw is closed.
-
Source code audits
We review the code for security flaws, with analysis tools, help from AI and a person confirming every finding.
- Critical flows reviewed by hand
- Dependencies and components
- A proposed fix for every flaw
-
Web application and API testing
We test applications the way an attacker would, within a scope and a time window agreed in writing.
- Authentication and permissions
- Input validation
- REST and GraphQL APIs
-
Infrastructure testing
We assess external exposure and the internal network: servers, services, remote access and the directory.
- External perimeter
- Internal network and Active Directory
- Configurations and versions
-
Mobile application testing
We analyse Android and iOS apps and the APIs they depend on, from data storage to communications.
- Data stored on the device
- Encrypted communications
- Back-end APIs
-
Fixes and retesting
We fix the flaws ourselves or support your team or supplier, and a retest confirms that each flaw is closed.
- Your choice
- Retest included
- Updated final report
-
Dependency monitoring
We keep track of the libraries and components in your systems and alert you when a critical flaw affects them.
- Prioritised alerts
- Planned fixes
- Up-to-date inventory
-
Security in development
Ongoing review of new code and training for developers in secure development.
- Review of every release
- OWASP good practice
- Hands-on training
-
NIS2 and incident response
Support with the inventory, risk analysis and measures of Portugal's Legal Framework for Cybersecurity, and help to contain and analyse an incident.
- Measures required by law
- Help with incident reporting
- 24/7 availability under contract
Methodology
Clear scope, safe testing, flaws closed.
See a sample report, with fictional findings explained from problem to fix.
-
Scope and authorisation
Systems, environments, test windows and contacts agreed and authorised in writing.
-
Analysis
Code audit and testing, with every finding reproduced and confirmed by a person.
-
Report
Findings by severity, with evidence, impact and a proposed fix, presented to your team.
-
Fixes
Made by us or by your team or supplier, with our support.
-
Retest
Confirmation that every flaw is closed and an updated final report.
-
Follow-up
Periodic testing and dependency monitoring, under the annual subscription.
How we work
The rules we follow in every test.
A security test is only useful if it is done with authorisation, care and confidentiality.
- Written authorisation: we only test what the system owner has authorised, within the agreed scope and time windows.
- No service interruptions: intrusive tests run in test environments or in agreed windows, with a direct contact throughout.
- Confidentiality: code, data and findings stay in the European Union, through our partners, or on your premises, and are never used to train AI models.
- Human confirmation: AI helps find candidates, but every finding in the report is reproduced and confirmed by a person.
- Recognised standards: OWASP methodologies and severity measured with CVSS, so results can be compared.
- Responsible disclosure: flaws in third-party products are reported to the vendor in a coordinated way.
Pricing
Fixed scope, fixed price.
You know what you will pay before we start, and retesting the fixed flaws is always included.
-
Audit or test by scope
A fixed price per application, API or infrastructure, set once we know the system.
- Fixed scope and price
- Retest included
-
Fixes
When we make the fixes, a fixed quote per finding or a bank of hours, as you prefer.
- Prioritised by severity
- Retest included
-
Annual subscription
Periodic testing, dependency monitoring and retesting of changes, for a fixed monthly fee.
- Agreed schedule
- Alerts on critical flaws
For public bodies
Getting ready for the Legal Framework for Cybersecurity, within public procurement rules.
We have worked with regional public administration since 2018, under contracts awarded through open tenders and direct awards.
- A free NIS2 session for senior staff and technicians: generic, without analysing the body's systems, about the new Legal Framework for Cybersecurity and the supply chain.
- Audits and tests with defined scope, deliverables and price, procured through the Public Contracts Code procedure that applies to each value.
- Start with one application and extend to the rest at the same unit price, when that option is provided for in the initial procedure.
- Payment after acceptance, against criteria set out in the specifications.
- Transparency: our public contracts can be consulted on the BASE portal (in Portuguese).
Free NIS2 session
Understand what changes under the new framework and what to ask of suppliers.
Price per application
Fixed amounts that help estimate the cost and choose the procedure.
Planned extension
Every new application follows the same method at the same price.
Confidentiality
Code and findings handled in the EU or on your premises.
Frequently asked questions
About our cybersecurity services.
Can the tests affect how our systems run?
We plan the tests so that they do not. The most intrusive tests run in test environments or in agreed windows, there is always a direct contact during the work, and we stop immediately if asked.
What is the difference between a code audit and a penetration test?
An audit looks at the system from the inside, reading the code for flaws. A penetration test looks from the outside, attacking the running system the way an attacker would. They complement each other: together they find more flaws than either one alone.
Who fixes the flaws we find?
You choose. We can make the fixes ourselves, in our own code or in third-party code, with authorisation, or hand over the proposed fixes and support your team or supplier. Either way, we retest.
Do you use artificial intelligence? Where does our code go?
We use AI tools to find suspicious patterns and data paths, and a person confirms every finding. The code is processed in the European Union, through our partners, or on your premises, only with your written agreement, and it is never used to train models.
How often should we test?
At least once a year and whenever there is a significant change, such as a new release, a new integration or a move to new hosting. The annual subscription covers this schedule.
Does this help with NIS2 compliance?
Yes, it supports the vulnerability management and supply chain security required by Portugal's Legal Framework for Cybersecurity. It does not replace each organisation's own obligations, such as appointing those responsible and reporting incidents, but we help prepare them.
If we have an incident out of hours, can we count on you?
Yes, around the clock, when the contract provides for it. Otherwise, we support you during office hours, with response times agreed in the contract.
Where would you like to start?
An audit, a test or a free NIS2 session: choose the first step.