--- title: SpySecure® | Cybersecurity FAQ for SMEs description: "Answers to frequently asked questions about cybersecurity for SMEs: pricing, EDR, Microsoft 365, DMARC, backups, NIS2 and more." --- ✓ Trusted by **100+** businesses★★★★★ **5.0** on Google[View our plans →](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) [![SpySecure](https://www.spysecure.nl/hs-fs/hubfs/SpySecure%20logo/logo%201%20(bold)%20-%20no%20white%20space%20-%20resized.png?width=200&height=40&name=logo%201%20(bold)%20-%20no%20white%20space%20-%20resized.png)](https://www.spysecure.nl/en/?hsLang=en) - Cybersecurity for businesses - All-in-one cybersecurity - Who it's for - Our approach - Pricing [NL](https://www.spysecure.nl/faq)[EN](https://www.spysecure.nl/en/faq) [Contact](https://www.spysecure.nl/en/contact?hsLang=en) - [Why cybersecurity?Risks and consequences for SMEs](https://www.spysecure.nl/en/why-cybersecurity-sme?hsLang=en) - [What security do you need?The security layers explained](https://www.spysecure.nl/en/security-layers-smes?hsLang=en) - [BlogInsights and current threats](https://www.spysecure.nl/en/knowledge?hsLang=en) - [WebinarsJoin live or watch on demand](https://www.spysecure.nl/events?hsLang=en) - [FAQQuick answers to your questions](https://www.spysecure.nl/en/faq) NIS2 Does NIS2 apply to your business? Read what the law requires and how to show your security is in order. [Go to NIS2 →](https://www.spysecure.nl/en/nis2?hsLang=en) [Managed SecurityAll security layers, fully managed and monitored 24/7→](https://www.spysecure.nl/en/managed-security?hsLang=en) [Security layers](https://www.spysecure.nl/en/approach?hsLang=en) - [Endpoints / devices](https://www.spysecure.nl/en/endpoint-security?hsLang=en) - [M365 & Google Workspace](https://www.spysecure.nl/en/microsoft-365-google-workspace-security?hsLang=en) - [Cloud & SaaS](https://www.spysecure.nl/en/cloud-security?hsLang=en) - [Email](https://www.spysecure.nl/emailbeveiliging?hsLang=en) - [Identities](https://www.spysecure.nl/identiteitenbeveiliging?hsLang=en) - [Backups](https://www.spysecure.nl/backups?hsLang=en) Training - [Employee training](https://www.spysecure.nl/en/training?hsLang=en) - [Phishing test](https://www.spysecure.nl/en/phishing-test?hsLang=en) Compliance - [Compliance management](https://www.spysecure.nl/en/compliance?hsLang=en) - [NIS2 compliance](https://www.spysecure.nl/en/nis2?hsLang=en) Scans & extras - [Vulnerability scan](https://www.spysecure.nl/en/vulnerability-scan?hsLang=en) - [Penetration test](https://www.spysecure.nl/pen-test?hsLang=en) - [Business password manager](https://www.spysecure.nl/en/business-password-manager?hsLang=en) - [Domain protection](https://www.spysecure.nl/en/domainprotection?hsLang=en) Plans From €9.99 per licence per month. Fully managed, including all the security software you need. [View the plans →](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) Businesses - [Startups & scale-ups](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [SMEs](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) Sectors - [E-commerce](https://www.spysecure.nl/en/cybersecurity-ecommerce?hsLang=en) - [Education](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [Healthcare](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [Professional services](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) Partners - [MSPs](https://www.spysecure.nl/en/partners?hsLang=en) - [IT partners](https://www.spysecure.nl/en/partners?hsLang=en) Customer stories ★★★★★ Trusted by 100+ businesses Read how business owners placed their security with us. [Read the customer stories →](https://www.spysecure.nl/en/our-customers?hsLang=en) - [Our approachHow we secure your business](https://www.spysecure.nl/en/approach?hsLang=en) - [How it worksFrom introduction to 24/7 monitoring](https://www.spysecure.nl/en/how-it-works?hsLang=en) - [Customer storiesExperiences of our customers](https://www.spysecure.nl/en/our-customers?hsLang=en) - [About usThe team behind SpySecure®](https://www.spysecure.nl/en/about-us?hsLang=en) Google reviews ★★★★★ 5.0 on Google Our customers rate us 5 stars. [What our customers say →](https://www.spysecure.nl/en/our-customers?hsLang=en) - [All-in-one plansFully managed · from €9.99 per licence](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) - [Individual servicesPer service · from €4.99 per licence](https://www.spysecure.nl/en/security-services?hsLang=en) [![SpySecure](https://www.spysecure.nl/hs-fs/hubfs/SpySecure%20logo/logo%201%20(bold)%20-%20no%20white%20space%20-%20resized.png?width=200&height=40&name=logo%201%20(bold)%20-%20no%20white%20space%20-%20resized.png)](https://www.spysecure.nl/en/?hsLang=en) Cybersecurity for businesses - [Why cybersecurity?Risks and consequences for SMEs](https://www.spysecure.nl/en/why-cybersecurity-sme?hsLang=en) - [What security do you need?The security layers explained](https://www.spysecure.nl/en/security-layers-smes?hsLang=en) - [BlogInsights and current threats](https://www.spysecure.nl/en/knowledge?hsLang=en) - [WebinarsJoin live or watch on demand](https://www.spysecure.nl/events?hsLang=en) - [FAQQuick answers to your questions](https://www.spysecure.nl/en/faq) All-in-one cybersecurity [Managed SecurityAll security layers, fully managed and monitored 24/7→](https://www.spysecure.nl/en/managed-security?hsLang=en) [Security layers](https://www.spysecure.nl/en/approach?hsLang=en) - [Endpoints / devices](https://www.spysecure.nl/en/endpoint-security?hsLang=en) - [M365 & Google Workspace](https://www.spysecure.nl/en/microsoft-365-google-workspace-security?hsLang=en) - [Cloud & SaaS](https://www.spysecure.nl/en/cloud-security?hsLang=en) - [Email](https://www.spysecure.nl/emailbeveiliging?hsLang=en) - [Identities](https://www.spysecure.nl/identiteitenbeveiliging?hsLang=en) - [Backups](https://www.spysecure.nl/backups?hsLang=en) Training - [Employee training](https://www.spysecure.nl/en/training?hsLang=en) - [Phishing test](https://www.spysecure.nl/en/phishing-test?hsLang=en) Compliance - [Compliance management](https://www.spysecure.nl/en/compliance?hsLang=en) - [NIS2 compliance](https://www.spysecure.nl/en/nis2?hsLang=en) Scans & extras - [Vulnerability scan](https://www.spysecure.nl/en/vulnerability-scan?hsLang=en) - [Penetration test](https://www.spysecure.nl/pen-test?hsLang=en) - [Business password manager](https://www.spysecure.nl/en/business-password-manager?hsLang=en) - [Domain protection](https://www.spysecure.nl/en/domainprotection?hsLang=en) Who it's for Businesses - [Startups & scale-ups](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [SMEs](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) Sectors - [E-commerce](https://www.spysecure.nl/en/cybersecurity-ecommerce?hsLang=en) - [Education](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [Healthcare](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) - [Professional services](https://www.spysecure.nl/en/business-cybersecurity?hsLang=en) Partners - [MSPs](https://www.spysecure.nl/en/partners?hsLang=en) - [IT partners](https://www.spysecure.nl/en/partners?hsLang=en) Our approach - [Our approachHow we secure your business](https://www.spysecure.nl/en/approach?hsLang=en) - [How it worksFrom introduction to 24/7 monitoring](https://www.spysecure.nl/en/how-it-works?hsLang=en) - [Customer storiesExperiences of our customers](https://www.spysecure.nl/en/our-customers?hsLang=en) - [About usThe team behind SpySecure®](https://www.spysecure.nl/en/about-us?hsLang=en) Pricing - [All-in-one plansFully managed · from €9.99 per licence](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) - [Individual servicesPer service · from €4.99 per licence](https://www.spysecure.nl/en/security-services?hsLang=en) [Contact](https://www.spysecure.nl/en/contact?hsLang=en) [NL](https://www.spysecure.nl/faq)[EN](https://www.spysecure.nl/en/faq)   FAQ # Frequently asked questions Clear   Popular:[What does it cost?](https://www.spysecure.nl/en/faq#what-cybersecurity-smes-cost-spysecure)[How fast live?](https://www.spysecure.nl/en/faq#how-quickly-protected)[What is EDR?](https://www.spysecure.nl/en/faq#what-edr)[NIS2](https://www.spysecure.nl/en/faq#does-nis2-apply-business)[SPF, DKIM & DMARC](https://www.spysecure.nl/en/faq#what-spf-dkim-dmarc) Topics [Pricing & subscription6](https://www.spysecure.nl/en/faq#faq-prijzen)[Getting started & how we work8](https://www.spysecure.nl/en/faq#faq-starten)[Threats & incidents5](https://www.spysecure.nl/en/faq#faq-dreigingen)[Endpoints & network devices5](https://www.spysecure.nl/en/faq#faq-endpoints)[Microsoft 365 & Google Workspace3](https://www.spysecure.nl/en/faq#faq-m365)[Cloud & SaaS apps3](https://www.spysecure.nl/en/faq#faq-cloud)[Email & domain5](https://www.spysecure.nl/en/faq#faq-email)[Identities & passwords5](https://www.spysecure.nl/en/faq#faq-identiteiten)[Backups & recovery4](https://www.spysecure.nl/en/faq#faq-backups)[Employees2](https://www.spysecure.nl/en/faq#faq-medewerkers)[Monitoring & SOC4](https://www.spysecure.nl/en/faq#faq-soc)[Compliance & NIS24](https://www.spysecure.nl/en/faq#faq-compliance)[Vulnerabilities & scans6](https://www.spysecure.nl/en/faq#faq-kwetsbaarheden) ## Pricing & subscription ### What does cybersecurity for SMEs cost at SpySecure?− The plans cost €9.99 (Managed Basic), €19.99 (Managed Standard) or €29.99 (Managed Advanced) per licence per month, fully managed. Individual services start at €4.99 per licence per month. There are no setup costs. [View the plans →](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en)[View individual services →](https://www.spysecure.nl/en/security-services?hsLang=en) ### What counts as a licence?− Every active account counts as one licence, including shared accounts such as info@. Accounts are a major risk: with one stolen password an attacker can reach email, files and customer data. Each licence includes one device. [View the plans →](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) ### Do network devices count as devices?− Yes. Firewalls, switches, routers, NAS and printers count as devices, just like laptops, desktops and servers. That way all your devices are in one overview, for example for the vulnerability scan. [More about endpoint security →](https://www.spysecure.nl/en/endpoint-security?hsLang=en) ### How long am I tied in?− Our subscriptions can be cancelled monthly. Larger organisations can choose a longer term with specific SLAs. [View the plans →](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en)[Get in touch →](https://www.spysecure.nl/en/contact?hsLang=en) ### Can I scale up and down?− Yes, per month. When people join or leave, you simply adjust the number of licences. [View the plans →](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) ### Which plan fits my business?− Managed Basic protects all your workstations, servers and network devices. Managed Standard adds Microsoft 365 or Google Workspace, cloud apps, email, identities and employee training; most businesses choose this plan. Managed Advanced is for organisations with stricter customer, NIS2 or ISO requirements and adds backups, compliance and 24/7 response by specialists. [View the plans →](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) ## Getting started & how we work ### How quickly are we protected?− You are live within 5 minutes. You install the software on your devices and give us admin access to, for example, Microsoft 365, Google Workspace or Salesforce. We do the rest. [How it works →](https://www.spysecure.nl/en/how-it-works?hsLang=en) ### How does SpySecure work in practice?− We connect your environment, set up the security layers and monitor everything 24/7. When we see suspicious activity, we investigate and step in. Every month you receive a report with actions and improvements. [How it works →](https://www.spysecure.nl/en/how-it-works?hsLang=en) ### Do you only do antivirus?− No. We provide and manage every security layer: endpoints and network devices, Microsoft 365 and Google Workspace, cloud apps, email, identities, employees, backups and compliance, with 24/7 monitoring and follow-up. [More about Managed Security →](https://www.spysecure.nl/en/managed-security?hsLang=en) ### Do I need my own IT team?− No. Many customers have a small IT team or work with an IT partner. We take security management and follow-up off your hands, with as little work as possible for your team. [How it works →](https://www.spysecure.nl/en/how-it-works?hsLang=en) ### We already have an IT partner or tools. How do you work together?− We build on what is already in place and agree clearly who does what: who manages which layer, who makes changes and who is the point of contact for incidents. Where possible we keep your existing security tools. [For IT partners →](https://www.spysecure.nl/en/partners?hsLang=en) ### How often are security updates installed?− Automatically and continuously. We keep supported operating systems and applications up to date, so known vulnerabilities are closed. You don’t need to do anything yourself. [More about endpoint security →](https://www.spysecure.nl/en/endpoint-security?hsLang=en) ### Where is our data stored?− In the EU. That keeps your data within European laws and regulations, including the GDPR. [Get in touch →](https://www.spysecure.nl/en/contact?hsLang=en) ### What reporting do we receive?− A clear monthly report per security layer: risks, incidents, actions taken and improvements. Suitable for management, audits and customer questions. [How it works →](https://www.spysecure.nl/en/how-it-works?hsLang=en) ## Threats & incidents ### What are the most common attacks on SMEs?− Mainly phishing, account misuse, ransomware and data leaks caused by misconfigured cloud apps. It often starts with one mailbox or one device and spreads quickly. [Why cybersecurity for SMEs →](https://www.spysecure.nl/en/why-cybersecurity-sme?hsLang=en) ### What are the biggest cybersecurity risks for SMEs?− Our survey of a hundred SMEs mainly shows: insufficiently secured devices, insecure cloud app settings, unprotected email, vulnerable accounts, missing automatic backups and insufficient financial cover for incidents. [Why cybersecurity for SMEs →](https://www.spysecure.nl/en/why-cybersecurity-sme?hsLang=en) ### How do I notice something is wrong?− Watch for unknown sign-in locations, new mailbox rules, unusual email sending, MFA prompts nobody recognises, unexpected admin changes and devices behaving oddly. Without monitoring, these signals often go unnoticed. [More about Managed Security →](https://www.spysecure.nl/en/managed-security?hsLang=en) ### What should I do immediately if I suspect an incident?− Disconnect the affected device from the network, change the passwords of suspicious accounts, pause risky integrations and record what you see (time, screenshots). Then contact us immediately. [Get in touch →](https://www.spysecure.nl/en/contact?hsLang=en) ### Why are suppliers often the way in for an attack?− Third parties often have access to systems, shared inboxes, integrations or files. If a supplier is hacked, that can reach you through accounts, integrations or email. We limit that access, review integrations and monitor continuously. [More about cloud and SaaS security →](https://www.spysecure.nl/en/cloud-security?hsLang=en) ## Endpoints & network devices ### What is EDR?− EDR stands for Endpoint Detection & Response. It continuously monitors what happens on laptops, desktops and servers, recognises attack behaviour and can stop an attack immediately, for example by isolating a device. [More about endpoint security →](https://www.spysecure.nl/en/endpoint-security?hsLang=en) ### Why isn’t antivirus alone enough?− Antivirus mainly recognises known malicious files. Attacks increasingly rely on stolen accounts, misused permissions and techniques that evade traditional detection. That is why we combine EDR with monitoring of all your security layers and 24/7 follow-up. [More about endpoint security →](https://www.spysecure.nl/en/endpoint-security?hsLang=en) ### Which devices does it work on?− EDR and antivirus run on laptops, desktops and servers with Windows, macOS and Linux. Network devices such as firewalls, switches, routers, NAS and printers are monitored centrally with fixed policies. [More about endpoint security →](https://www.spysecure.nl/en/endpoint-security?hsLang=en) ### What is BYOD and how do you secure it?− BYOD stands for Bring Your Own Device: employees use their own phone or laptop for work. We set conditions for access, such as encryption, updates, screen lock and secure access to email and data, with policies per device and per user. [More about endpoint security →](https://www.spysecure.nl/en/endpoint-security?hsLang=en) ### How do I know which devices are protected?− You get an overview of all devices and their security status. Deviations, risks and actions taken are included in the monthly report. [More about endpoint security →](https://www.spysecure.nl/en/endpoint-security?hsLang=en) ## Microsoft 365 & Google Workspace ### Aren’t Microsoft 365 and Google Workspace secure already?− Microsoft and Google secure their platform, but the settings, accounts and data are your responsibility. Most incidents are caused by stolen credentials, wrong settings and misused permissions. That is what we focus on. [More about Microsoft 365 & Google Workspace →](https://www.spysecure.nl/en/microsoft-365-google-workspace-security?hsLang=en) ### What do you monitor in Microsoft 365 and Google Workspace?− All activity: sign-ins, files, sharing links, mail rules, permissions and connected apps. We recognise abnormal behaviour such as impossible travel, mass downloads, privilege escalation and suspicious forwarding rules, and step in immediately. [More about Microsoft 365 & Google Workspace →](https://www.spysecure.nl/en/microsoft-365-google-workspace-security?hsLang=en) ### What is hardening and why does it matter?− Hardening means tightening settings so attackers get fewer opportunities. Think of switching off risky options, limiting access, enforcing policies and setting up logging properly. [More about Microsoft 365 & Google Workspace →](https://www.spysecure.nl/en/microsoft-365-google-workspace-security?hsLang=en) ## Cloud & SaaS apps ### What are the biggest risks in cloud and SaaS apps?− Wrong settings, overly broad access, risky integrations and too little logging. Many incidents happen because accounts or integrations are allowed more than they need. [More about cloud and SaaS security →](https://www.spysecure.nl/en/cloud-security?hsLang=en) ### Can you secure our CRM and other SaaS apps?− Yes. We monitor apps such as Salesforce, Slack and Dropbox: sign-ins, exports, sharing links and permissions. We set up security (MFA, roles, secure settings), limit risky integrations and step in on abnormal behaviour, such as a mass export. [More about cloud and SaaS security →](https://www.spysecure.nl/en/cloud-security?hsLang=en) ### How do we stop former employees from keeping access?− By monitoring accounts and access to all apps centrally. Accounts that are no longer in use, or activity that doesn’t fit someone’s role, stand out immediately, so we can revoke access before data disappears. [More about cloud and SaaS security →](https://www.spysecure.nl/en/cloud-security?hsLang=en)[More about identity security →](https://www.spysecure.nl/en/identity-security?hsLang=en) ## Email & domain ### Why is phishing still a risk, even with a spam filter?− Attackers use legitimate services, new domains or hacked accounts, so messages look trustworthy. That is why we combine advanced email protection with domain protection, secure settings and employee training. [More about email security →](https://www.spysecure.nl/en/email-security?hsLang=en) ### What is CEO fraud and how do you prevent it?− In CEO fraud, an attacker poses by email as a director or supplier and asks for an urgent payment or changed bank details. Email protection recognises many of these messages. Also agree that payments and changes of bank details are always verified through a second channel. [More about email security →](https://www.spysecure.nl/en/email-security?hsLang=en) ### What are SPF, DKIM and DMARC?− SPF defines which servers may send email on behalf of your domain. DKIM adds a digital signature. DMARC tells receivers what to do with email that fails those checks: let it through, quarantine it or reject it. Together they stop criminals sending email in the name of your domain. [More about domain protection →](https://www.spysecure.nl/en/domain-protection?hsLang=en) ### How do you prevent misuse of our domain?− With domain protection: we set up and continuously monitor SPF, DKIM, DMARC and BIMI. We move step by step to a strict DMARC policy, without blocking your own email. Domain protection costs €19.99 per domain per month. [More about domain protection →](https://www.spysecure.nl/en/domain-protection?hsLang=en) ### What should employees do with a suspicious email?− Don’t click, don’t forward and report it immediately. We support with instructions, e-learning and phishing tests, and make sure reports are followed up. [More about employee training →](https://www.spysecure.nl/en/training?hsLang=en) ## Identities & passwords ### Is MFA enough to protect accounts?− MFA is a strong foundation, but not enough. Attackers also steal sessions, abuse MFA prompts and target admin accounts. That is why we continuously monitor sign-ins, sessions and permissions, and step in on misuse. [More about identity security →](https://www.spysecure.nl/en/identity-security?hsLang=en) ### What is dark web monitoring?− We check whether your employees’ credentials appear in leaked databases on the dark web. If we find a leaked password, we have it replaced before an attacker can use it. [More about identity security →](https://www.spysecure.nl/en/identity-security?hsLang=en) ### What are the biggest risks around admin accounts?− Too many permissions, too little control and no separation between everyday accounts and admin accounts. That is why we use minimal permissions, extra security and logging of admin actions. [More about identity security →](https://www.spysecure.nl/en/identity-security?hsLang=en) ### What do you do with a suspicious account?− We investigate the signals and step in: ending sessions, having the password changed, tightening MFA and limiting permissions. Then we handle recovery and measures to prevent a repeat. [More about identity security →](https://www.spysecure.nl/en/identity-security?hsLang=en) ### Do you offer a business password manager?− Yes, as an individual service. We provide 1Password Business and take care of setup and management, so everyone uses strong, unique passwords and you can share passwords safely within teams. [More about the password manager →](https://www.spysecure.nl/en/business-password-manager?hsLang=en) ## Backups & recovery ### What often goes wrong with backups?− Backups are made but not tested, or they sit in the same environment and get encrypted along with everything else in an attack. Good backups are stored separately, protected against deletion and tested regularly. [More about backups →](https://www.spysecure.nl/en/backups?hsLang=en) ### Why are backups often not enough against ransomware?− Attackers also encrypt or delete backups. That is why we use backups that cannot be changed or deleted (immutable) and keep copies separately. That way recovery remains possible. [More about backups →](https://www.spysecure.nl/en/backups?hsLang=en) ### Don’t Microsoft 365 and Google Workspace make backups themselves?− Not the way you would expect. They keep deleted data for a limited time and mainly offer a recycle bin. A real backup accounts for longer retention, recovery scenarios and protection against malicious deletion. [More about backups →](https://www.spysecure.nl/en/backups?hsLang=en) ### Which plan includes backups?− Backups are included in Managed Advanced, including monitoring and recovery checks. [View the plans →](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en)[More about backups →](https://www.spysecure.nl/en/backups?hsLang=en) ## Employees ### Do you provide security awareness training and phishing tests?− Yes. Employees receive short monthly e-learnings and realistic phishing tests, with targeted follow-up and progress reports. That way they learn to recognise and report attacks. [More about employee training →](https://www.spysecure.nl/en/training?hsLang=en)[More about phishing tests →](https://www.spysecure.nl/en/phishing-test?hsLang=en) ### What is a good internal rule for email and attachments?− One simple rule: check first, act later. When in doubt, always report it. And always verify payments or changed bank details through a second channel, such as a phone call. [More about employee training →](https://www.spysecure.nl/en/training?hsLang=en) ## Monitoring & SOC ### What is a SOC?− A Security Operations Center (SOC) monitors your environment 24/7 and responds to threats such as phishing, ransomware and unauthorised access. At SpySecure, SOC monitoring is included in every plan. [More about Managed Security →](https://www.spysecure.nl/en/managed-security?hsLang=en) ### What is MDR?− MDR stands for Managed Detection & Response. We monitor signals from all your security layers and step in on suspicious activity. You don’t need to build your own SOC. [More about Managed Security →](https://www.spysecure.nl/en/managed-security?hsLang=en) ### What is the difference between automated response and response by specialists?− In every plan we respond automatically 24/7 according to fixed rules, for example by isolating an infected device. In Managed Advanced our specialists also respond 24/7: they investigate, step in and guide recovery. [View the plans →](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) ### What happens when you see something suspicious?− We investigate the cause, step in (for example by blocking an account or isolating a device) and guide recovery. You receive a clear summary with cause, impact and next steps. [How it works →](https://www.spysecure.nl/en/how-it-works?hsLang=en) ## Compliance & NIS2 ### Does NIS2 apply to my business?− NIS2 applies to medium-sized and large organisations in a wide range of sectors. In the Netherlands it is implemented through the Cybersecurity Act (Cyberbeveiligingswet). Even if it doesn’t apply to you directly, customers that fall under it often place the same requirements on their suppliers. [More about NIS2 →](https://www.spysecure.nl/en/nis2?hsLang=en) ### What does NIS2 require in practice?− That you manage risks, take appropriate measures, can detect and follow up incidents, and can demonstrate all of this. It is not just about policy on paper, but about execution and monitoring. [More about NIS2 →](https://www.spysecure.nl/en/nis2?hsLang=en) ### Do you help with ISO 27001 and SOC 2?− Yes. With our Compliance Manager you map risks and measures centrally, linked to NIS2, ISO 27001 and SOC 2. You keep track through tasks, evidence and exportable reports for management, auditors and customers. Compliance is included in Managed Advanced. [More about compliance →](https://www.spysecure.nl/en/compliance?hsLang=en) ### Is compliance mostly paperwork?− No. The core is that measures really work and that you can demonstrate it. Good compliance follows from good management, monitoring and follow-up, with smart documentation around it. [More about compliance →](https://www.spysecure.nl/en/compliance?hsLang=en) ## Vulnerabilities & scans ### What is a vulnerability?− A vulnerability is a weakness in software, a device or a setting that lets an attacker get in, for example a missing update, an outdated firewall or an open port that is publicly reachable. [More about the vulnerability scan →](https://www.spysecure.nl/en/vulnerability-scan?hsLang=en) ### What is a CVE?− CVE stands for Common Vulnerabilities and Exposures: a public list in which every known vulnerability gets its own number, such as CVE-2024-12345. A CVSS score from 0 to 10 indicates how severe the vulnerability is. That tells you which gaps to close first. [More about the vulnerability scan →](https://www.spysecure.nl/en/vulnerability-scan?hsLang=en) ### What is the difference between an internal and an external vulnerability scan?− An internal scan looks at your devices from the inside: laptops, servers and network devices such as firewalls, switches and NAS. An external scan looks from the internet at what an attacker sees from the outside, such as public IP addresses, open ports, websites and mail servers. Together they give a complete picture. [More about the vulnerability scan →](https://www.spysecure.nl/en/vulnerability-scan?hsLang=en) ### What happens to vulnerabilities that are found?− We rank them by severity and risk, so the most important gaps are dealt with first. What we manage, we fix, for example with updates. For the rest you get a clear overview with advice. [More about the vulnerability scan →](https://www.spysecure.nl/en/vulnerability-scan?hsLang=en) ### What is the difference between a vulnerability scan and a penetration test?− A vulnerability scan automatically looks for known vulnerabilities in your devices and systems. In a penetration test, ethical hackers manually try to break in, as a real attacker would. The scan gives broad insight; the penetration test shows how far an attacker would really get. [More about the vulnerability scan →](https://www.spysecure.nl/en/vulnerability-scan?hsLang=en)[More about the penetration test →](https://www.spysecure.nl/en/penetration-test?hsLang=en) ### When do I need a penetration test?− For example when customers or an audit ask for it, after major changes to your systems or applications, or to check whether your security holds up in practice. After the test you receive a report with findings and concrete improvements. [More about the penetration test →](https://www.spysecure.nl/en/penetration-test?hsLang=en) Contact ## Get in touch A question about our services, a quote or your existing service? Leave your details and we’ll get back to you as soon as possible. Prefer to talk directly? Call [+31 20 261 2897](tel:+31202612897) Email [contact@spysecure.nl](mailto:contact@spysecure.nl) [![SpySecure](https://www.spysecure.nl/hs-fs/hubfs/SpySecure%20logo/logo%20white%20(bold)%20-%20transparent%20-%20sized.png?width=200&height=34&name=logo%20white%20(bold)%20-%20transparent%20-%20sized.png)](https://www.spysecure.nl/en/?hsLang=en) Fully managed cybersecurity, training and compliance for scale-ups and SMEs. - 24/7 monitoring, detection and response - Monthly reporting ### Solutions - [Managed Security](https://www.spysecure.nl/en/managed-security?hsLang=en) - [Compliance](https://www.spysecure.nl/compliance?hsLang=en) - [Security Awareness Training](https://www.spysecure.nl/training?hsLang=en) - [NIS2](https://www.spysecure.nl/nis2?hsLang=en) - [Domain protection](https://www.spysecure.nl/domeinbescherming?hsLang=en) - [For IT partners](https://www.spysecure.nl/partners?hsLang=en) ### Pricing - [All-in-one plans](https://www.spysecure.nl/en/cybersecurity-packages?hsLang=en) - [Individual services](https://www.spysecure.nl/en/security-services?hsLang=en) ### Resources - [Events and webinars](https://www.spysecure.nl/events?hsLang=en) - [Blog](https://www.spysecure.nl/kennisbank?hsLang=en) - [FAQ](https://www.spysecure.nl/en/faq) - [Customer stories](https://www.spysecure.nl/en/our-customers?hsLang=en) ### Contact - [Book an introduction](https://www.spysecure.nl/en/contact?hsLang=en) - [contact@spysecure.nl](mailto:contact@spysecure.nl) - [+31 20 261 2897](tel:+31202612897) ### Newsletter Once a month: the key threats and tips for your business. Ask AI about SpySecure®[ChatGPT](https://chatgpt.com/?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Claude](https://claude.ai/new?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Gemini](https://gemini.google.com/app?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Perplexity](https://www.perplexity.ai/search?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Copilot](https://copilot.microsoft.com/?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.)[Grok](https://grok.com/?q=Explain+what+SpySecure+%28spysecure.nl%29+does%3A+how+it+helps+SMEs+and+scale-ups+with+fully+managed+cybersecurity+and+compliance+%28NIS2%2C+ISO+27001%2C+SOC+2%29%2C+what+the+packages+include+and+what+its+key+benefits+are.) © SpySecure® 2026. All rights reserved. [Privacy](https://www.spysecure.nl/privacy-policy?hsLang=en)[Cookies](https://www.spysecure.nl/cookie-policy?hsLang=en)[Terms](https://www.spysecure.nl/en/terms?hsLang=en) ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "inLanguage" : "en", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The plans cost €9.99 (Managed Basic), €19.99 (Managed Standard) or €29.99 (Managed Advanced) per licence per month, fully managed. Individual services start at €4.99 per licence per month. There are no setup costs." }, "name" : "What does cybersecurity for SMEs cost at SpySecure?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Every active account counts as one licence, including shared accounts such as info@. Accounts are a major risk: with one stolen password an attacker can reach email, files and customer data. Each licence includes one device." }, "name" : "What counts as a licence?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. Firewalls, switches, routers, NAS and printers count as devices, just like laptops, desktops and servers. That way all your devices are in one overview, for example for the vulnerability scan." }, "name" : "Do network devices count as devices?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Our subscriptions can be cancelled monthly. Larger organisations can choose a longer term with specific SLAs." }, "name" : "How long am I tied in?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, per month. When people join or leave, you simply adjust the number of licences." }, "name" : "Can I scale up and down?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Managed Basic protects all your workstations, servers and network devices. Managed Standard adds Microsoft 365 or Google Workspace, cloud apps, email, identities and employee training; most businesses choose this plan. Managed Advanced is for organisations with stricter customer, NIS2 or ISO requirements and adds backups, compliance and 24/7 response by specialists." }, "name" : "Which plan fits my business?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "You are live within 5 minutes. You install the software on your devices and give us admin access to, for example, Microsoft 365, Google Workspace or Salesforce. We do the rest." }, "name" : "How quickly are we protected?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "We connect your environment, set up the security layers and monitor everything 24/7. When we see suspicious activity, we investigate and step in. Every month you receive a report with actions and improvements." }, "name" : "How does SpySecure work in practice?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. We provide and manage every security layer: endpoints and network devices, Microsoft 365 and Google Workspace, cloud apps, email, identities, employees, backups and compliance, with 24/7 monitoring and follow-up." }, "name" : "Do you only do antivirus?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. Many customers have a small IT team or work with an IT partner. We take security management and follow-up off your hands, with as little work as possible for your team." }, "name" : "Do I need my own IT team?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "We build on what is already in place and agree clearly who does what: who manages which layer, who makes changes and who is the point of contact for incidents. Where possible we keep your existing security tools." }, "name" : "We already have an IT partner or tools. How do you work together?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Automatically and continuously. We keep supported operating systems and applications up to date, so known vulnerabilities are closed. You don’t need to do anything yourself." }, "name" : "How often are security updates installed?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "In the EU. That keeps your data within European laws and regulations, including the GDPR." }, "name" : "Where is our data stored?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A clear monthly report per security layer: risks, incidents, actions taken and improvements. Suitable for management, audits and customer questions." }, "name" : "What reporting do we receive?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Mainly phishing, account misuse, ransomware and data leaks caused by misconfigured cloud apps. It often starts with one mailbox or one device and spreads quickly." }, "name" : "What are the most common attacks on SMEs?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Our survey of a hundred SMEs mainly shows: insufficiently secured devices, insecure cloud app settings, unprotected email, vulnerable accounts, missing automatic backups and insufficient financial cover for incidents." }, "name" : "What are the biggest cybersecurity risks for SMEs?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Watch for unknown sign-in locations, new mailbox rules, unusual email sending, MFA prompts nobody recognises, unexpected admin changes and devices behaving oddly. Without monitoring, these signals often go unnoticed." }, "name" : "How do I notice something is wrong?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Disconnect the affected device from the network, change the passwords of suspicious accounts, pause risky integrations and record what you see (time, screenshots). Then contact us immediately." }, "name" : "What should I do immediately if I suspect an incident?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Third parties often have access to systems, shared inboxes, integrations or files. If a supplier is hacked, that can reach you through accounts, integrations or email. We limit that access, review integrations and monitor continuously." }, "name" : "Why are suppliers often the way in for an attack?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "EDR stands for Endpoint Detection & Response. It continuously monitors what happens on laptops, desktops and servers, recognises attack behaviour and can stop an attack immediately, for example by isolating a device." }, "name" : "What is EDR?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Antivirus mainly recognises known malicious files. Attacks increasingly rely on stolen accounts, misused permissions and techniques that evade traditional detection. That is why we combine EDR with monitoring of all your security layers and 24/7 follow-up." }, "name" : "Why isn’t antivirus alone enough?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "EDR and antivirus run on laptops, desktops and servers with Windows, macOS and Linux. Network devices such as firewalls, switches, routers, NAS and printers are monitored centrally with fixed policies." }, "name" : "Which devices does it work on?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "BYOD stands for Bring Your Own Device: employees use their own phone or laptop for work. We set conditions for access, such as encryption, updates, screen lock and secure access to email and data, with policies per device and per user." }, "name" : "What is BYOD and how do you secure it?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "You get an overview of all devices and their security status. Deviations, risks and actions taken are included in the monthly report." }, "name" : "How do I know which devices are protected?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Microsoft and Google secure their platform, but the settings, accounts and data are your responsibility. Most incidents are caused by stolen credentials, wrong settings and misused permissions. That is what we focus on." }, "name" : "Aren’t Microsoft 365 and Google Workspace secure already?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "All activity: sign-ins, files, sharing links, mail rules, permissions and connected apps. We recognise abnormal behaviour such as impossible travel, mass downloads, privilege escalation and suspicious forwarding rules, and step in immediately." }, "name" : "What do you monitor in Microsoft 365 and Google Workspace?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Hardening means tightening settings so attackers get fewer opportunities. Think of switching off risky options, limiting access, enforcing policies and setting up logging properly." }, "name" : "What is hardening and why does it matter?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Wrong settings, overly broad access, risky integrations and too little logging. Many incidents happen because accounts or integrations are allowed more than they need." }, "name" : "What are the biggest risks in cloud and SaaS apps?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. We monitor apps such as Salesforce, Slack and Dropbox: sign-ins, exports, sharing links and permissions. We set up security (MFA, roles, secure settings), limit risky integrations and step in on abnormal behaviour, such as a mass export." }, "name" : "Can you secure our CRM and other SaaS apps?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "By monitoring accounts and access to all apps centrally. Accounts that are no longer in use, or activity that doesn’t fit someone’s role, stand out immediately, so we can revoke access before data disappears." }, "name" : "How do we stop former employees from keeping access?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Attackers use legitimate services, new domains or hacked accounts, so messages look trustworthy. That is why we combine advanced email protection with domain protection, secure settings and employee training." }, "name" : "Why is phishing still a risk, even with a spam filter?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "In CEO fraud, an attacker poses by email as a director or supplier and asks for an urgent payment or changed bank details. Email protection recognises many of these messages. Also agree that payments and changes of bank details are always verified through a second channel." }, "name" : "What is CEO fraud and how do you prevent it?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "SPF defines which servers may send email on behalf of your domain. DKIM adds a digital signature. DMARC tells receivers what to do with email that fails those checks: let it through, quarantine it or reject it. Together they stop criminals sending email in the name of your domain." }, "name" : "What are SPF, DKIM and DMARC?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "With domain protection: we set up and continuously monitor SPF, DKIM, DMARC and BIMI. We move step by step to a strict DMARC policy, without blocking your own email. Domain protection costs €19.99 per domain per month." }, "name" : "How do you prevent misuse of our domain?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Don’t click, don’t forward and report it immediately. We support with instructions, e-learning and phishing tests, and make sure reports are followed up." }, "name" : "What should employees do with a suspicious email?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "MFA is a strong foundation, but not enough. Attackers also steal sessions, abuse MFA prompts and target admin accounts. That is why we continuously monitor sign-ins, sessions and permissions, and step in on misuse." }, "name" : "Is MFA enough to protect accounts?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "We check whether your employees’ credentials appear in leaked databases on the dark web. If we find a leaked password, we have it replaced before an attacker can use it." }, "name" : "What is dark web monitoring?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Too many permissions, too little control and no separation between everyday accounts and admin accounts. That is why we use minimal permissions, extra security and logging of admin actions." }, "name" : "What are the biggest risks around admin accounts?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "We investigate the signals and step in: ending sessions, having the password changed, tightening MFA and limiting permissions. Then we handle recovery and measures to prevent a repeat." }, "name" : "What do you do with a suspicious account?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, as an individual service. We provide 1Password Business and take care of setup and management, so everyone uses strong, unique passwords and you can share passwords safely within teams." }, "name" : "Do you offer a business password manager?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Backups are made but not tested, or they sit in the same environment and get encrypted along with everything else in an attack. Good backups are stored separately, protected against deletion and tested regularly." }, "name" : "What often goes wrong with backups?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Attackers also encrypt or delete backups. That is why we use backups that cannot be changed or deleted (immutable) and keep copies separately. That way recovery remains possible." }, "name" : "Why are backups often not enough against ransomware?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Not the way you would expect. They keep deleted data for a limited time and mainly offer a recycle bin. A real backup accounts for longer retention, recovery scenarios and protection against malicious deletion." }, "name" : "Don’t Microsoft 365 and Google Workspace make backups themselves?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Backups are included in Managed Advanced, including monitoring and recovery checks." }, "name" : "Which plan includes backups?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. Employees receive short monthly e-learnings and realistic phishing tests, with targeted follow-up and progress reports. That way they learn to recognise and report attacks." }, "name" : "Do you provide security awareness training and phishing tests?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "One simple rule: check first, act later. When in doubt, always report it. And always verify payments or changed bank details through a second channel, such as a phone call." }, "name" : "What is a good internal rule for email and attachments?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A Security Operations Center (SOC) monitors your environment 24/7 and responds to threats such as phishing, ransomware and unauthorised access. At SpySecure, SOC monitoring is included in every plan." }, "name" : "What is a SOC?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "MDR stands for Managed Detection & Response. We monitor signals from all your security layers and step in on suspicious activity. You don’t need to build your own SOC." }, "name" : "What is MDR?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "In every plan we respond automatically 24/7 according to fixed rules, for example by isolating an infected device. In Managed Advanced our specialists also respond 24/7: they investigate, step in and guide recovery." }, "name" : "What is the difference between automated response and response by specialists?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "We investigate the cause, step in (for example by blocking an account or isolating a device) and guide recovery. You receive a clear summary with cause, impact and next steps." }, "name" : "What happens when you see something suspicious?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "NIS2 applies to medium-sized and large organisations in a wide range of sectors. In the Netherlands it is implemented through the Cybersecurity Act (Cyberbeveiligingswet). Even if it doesn’t apply to you directly, customers that fall under it often place the same requirements on their suppliers." }, "name" : "Does NIS2 apply to my business?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "That you manage risks, take appropriate measures, can detect and follow up incidents, and can demonstrate all of this. It is not just about policy on paper, but about execution and monitoring." }, "name" : "What does NIS2 require in practice?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. With our Compliance Manager you map risks and measures centrally, linked to NIS2, ISO 27001 and SOC 2. You keep track through tasks, evidence and exportable reports for management, auditors and customers. Compliance is included in Managed Advanced." }, "name" : "Do you help with ISO 27001 and SOC 2?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. The core is that measures really work and that you can demonstrate it. Good compliance follows from good management, monitoring and follow-up, with smart documentation around it." }, "name" : "Is compliance mostly paperwork?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A vulnerability is a weakness in software, a device or a setting that lets an attacker get in, for example a missing update, an outdated firewall or an open port that is publicly reachable." }, "name" : "What is a vulnerability?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CVE stands for Common Vulnerabilities and Exposures: a public list in which every known vulnerability gets its own number, such as CVE-2024-12345. A CVSS score from 0 to 10 indicates how severe the vulnerability is. That tells you which gaps to close first." }, "name" : "What is a CVE?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "An internal scan looks at your devices from the inside: laptops, servers and network devices such as firewalls, switches and NAS. An external scan looks from the internet at what an attacker sees from the outside, such as public IP addresses, open ports, websites and mail servers. Together they give a complete picture." }, "name" : "What is the difference between an internal and an external vulnerability scan?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "We rank them by severity and risk, so the most important gaps are dealt with first. What we manage, we fix, for example with updates. For the rest you get a clear overview with advice." }, "name" : "What happens to vulnerabilities that are found?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A vulnerability scan automatically looks for known vulnerabilities in your devices and systems. In a penetration test, ethical hackers manually try to break in, as a real attacker would. The scan gives broad insight; the penetration test shows how far an attacker would really get." }, "name" : "What is the difference between a vulnerability scan and a penetration test?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "For example when customers or an audit ask for it, after major changes to your systems or applications, or to check whether your security holds up in practice. After the test you receive a report with findings and concrete improvements." }, "name" : "When do I need a penetration test?" } ], "url" : "https://www.spysecure.nl/en/faq" } ```