When the platform is in production, two things matter
It stays up. It does not leak. We do both with one team, because in practice they are the same job - operations gives you the runbooks, security gives you the threat model. Run them in isolation and the gaps between them become the incidents.
For functional, performance and locale testing, see our dedicated QA & Test Automation service.
When this fits
- You handle sensitive data - patient records, financial data, personal data - and “we have a firewall” is not enough anymore.
- You are entering a regulated market (eHealth, fintech) and need audit-ready pentest reports and remediation evidence.
- A grown system needs hosting, monitoring and an on-call rotation that does not depend on a single hero.
- A major modernisation, migration or M&A integration is on the table and you cannot afford a breach or an unplanned outage.
- The threat model has shifted - new product surface, new third parties, new geography - and last year’s pentest no longer covers what is shipping today.
- A new CVE just hit the news and the team cannot answer “is it in our stack, and is it actually exploitable” within the day.
What we deliver
Operations and hosting
Hosting lives in Switzerland, the EU, or North America - matched to your regulatory geography (FADP, GDPR, Quebec Law 25, CCPA). Infrastructure and KPI monitoring carry alerting that an on-call team can act on, not just stare at. SLOs, runbooks and incident playbooks make sure the second incident is faster than the first. Backups and disaster recovery are real, not theoretical: point-in-time recovery, cross-region redundancy, tested restores. Cloud configurations are hardened against CIS benchmarks, with tenant isolation and identity management reviewed.
Artifact and infrastructure introspection
Knowing what is actually running, down to the transitive dependency, is what turns a CVE headline into a 20-minute answer instead of a week-long fire drill.
Every shipped artifact carries an SBOM (Software Bill of Materials), so we can show what is in production today down to the transitive dependency. The CVE feed is matched continuously against those SBOMs and your infrastructure inventory - when a new CVE is published, we know within minutes whether it touches anything you run. The follow-up question - reachability, network exposure, privilege context - is what separates “present” from “actually exploitable”, and we answer it before it becomes a fire drill. Container images are scanned both in the registry and at deploy time, gated on policy. The infrastructure inventory itself (cloud accounts, hosts, services, IAM) is kept current, so a CVE response is not a discovery exercise. The remediation playbook prioritises by exploitability, not by CVSS score alone.
Security, pentests and red teaming
- Penetration tests on web apps, APIs, cloud workloads, mobile apps and industrial systems.
- Red-team engagements: scenario-driven exercises that emulate a real adversary against the people, the process and the platform - not just the code.
- Architecture and code reviews focused on auth, authorization, secret handling, secure defaults.
- Compliance advisory for Swiss FADP, EU GDPR, ISO 27001, OWASP ASVS.
- Incident readiness: playbooks, logging strategy, response drills.
- Re-test offer once your patches land - so you have written proof the findings are closed.
How we work
We align with OWASP ASVS and OSSTMM for application security, MITRE ATT&CK for threat modelling and red-team scenarios, and CIS benchmarks for cloud hardening. Each engagement starts with explicit scoping, has agreed checkpoints, and ends with a written report: management summary, technical findings, prioritised actions.
Why Luzid
- 20+ years building and operating production-critical software in regulated environments.
- One team for hosting, monitoring, on-call and security - so the gaps between disciplines do not become the incidents.
- We deliver findings with a fix path, not a CVE list.
- Reports speak the language of stakeholders, not just engineers.
- Trilingual in German, French and English.
How often should we run pentests?
At least annually, plus after any major architecture or infrastructure change. In regulated sectors (eHealth, finance) auditors typically expect documented yearly tests.
How does your methodology differ from a tool scan?
Tool scans find known CVEs. We also look for business-logic gaps, permission flaws and architectural weaknesses - the things attackers actually exploit and tools cannot see.
When a new CVE drops, how fast do we know if we are exposed?
Within minutes of the advisory publishing. Every shipped artifact has an SBOM, the infrastructure inventory is kept current, and the CVE feed is matched continuously. The follow-up question - "is it actually exploitable in our environment" - is answered in hours, not days, by reachability and exposure analysis. That gap is where most teams lose control during a CVE incident.
Do we get a re-test after fixes?
Yes. We offer a re-test once your patches are in place, so you have written proof that the findings are closed.
What kind of operations support can I expect?
Around-the-clock monitoring, with phone, email and chat for routine work. For mission-critical systems we offer 24/7 on-call packages tied to your SLOs.
How do you handle backups and recovery?
Automated regular backups with point-in-time recovery, cross-region redundancy where required, and tested disaster-recovery procedures. We document the RPO and RTO and rehearse the restore.
Are your services compliant with local regulations?
Yes - at the engagement scope you choose. Hosting and operations are matched to your regulatory geography (nFADP, GDPR, HIPAA, CCPA, Quebec Law 25), with the data-residency choices and audit trails that go with it.