An organisation legally prepared for a cyber incident.

The scope of the test, authorisation, data-access limits, the confidentiality of the findings, and the allocation of liability must be in writing; otherwise the testing activity itself may turn into unlawful access. We build your test contracts within this framework.

An examination conducted under attorney coordination provides protection with respect to legal privilege, the chain of custody, and any potential litigation strategy. We structure the report together with the technical team within a scope suited to litigation and notification needs.

The decision to pay carries serious risks in terms of sanctions lists, anti-money-laundering rules, and insurance conditions, and should never be made in isolation. We manage the decision process by documenting it within a legal framework and handle the notification obligations in parallel.

Notification to the authority and public disclosure are different things: in certain cases the KVKK/GDPR also require notifying the data subjects. We determine the scope as a legal matter and structure the disclosure text so that it does not increase litigation risk.

Outsourcing does not remove liability; your obligations as the data controller continue. Recourse against the provider, in turn, depends on the security and indemnity clauses in your contract — those clauses need to be built strong from the start.

With the right coverage, yes; but policies are tied to conditions such as notification deadlines and security undertakings, and coverage can be denied if these are breached. We test your policy against incident scenarios and pursue your rights through the claims process.