Software · Penetration testing · NIS2/KSC · DORA
We build custom software for large companies and enterprises, with security designed in from day one. We independently test applications and infrastructure and help organisations prepare for NIS2/KSC and DORA requirements - with data kept in the EU.
innovix-audit --target api.firma.example --wstg v4.2[*] OWASP WSTG v4.2 scan initiatedOKTLS: A+ hardened (TLS 1.3, HSTS preload)OKSecurity headers: compliant!!/api/users/:id - IDOR (CVSS 7.5)!!/api/upload - missing rate limitOKCSRF tokens: HMAC-SHA256OKSession: HttpOnly + Secure + SameSite=Strict14 findings · CVSS median 4.7 · report in 5 days4.7
Median CVSS
14 vulnerabilities in the report
87%
NIS2 compliance
142 of 156 controls
Sample test run - demonstration data
Industries we work for:
Methodologies and frameworks:
01Services
We build systems for companies and enterprises, and we independently test their security - including systems built by other vendors.
Software house
We design and build custom software - from architecture to deployment, further development and maintenance. Security and regulatory compliance are part of the architecture, not a document at the end of the project.
Security
We test applications, APIs and infrastructure following OWASP WSTG and PTES - every vulnerability comes with technical evidence and a CVSS score. We help organisations prepare for NIS2/KSC and DORA requirements and carry out the audit required by the Polish KSC Act in cooperation with a partner.
Pentest
Authentication, authorisation, business logic and configuration - with a retest of every vulnerability once it is fixed.
NIS2/KSC
A gap analysis against the requirements of the Polish KSC Act and a prioritised implementation plan.
AI
Language models in your own infrastructure or in a private cloud in the EU - your data does not go to external providers.
Software
Rebuilding and migrating legacy systems while keeping business continuity and security intact.
02NIS2/KSC
The amendment to the Polish National Cybersecurity System Act (KSC Act), which implements the NIS2 Directive, has applied since 3 April 2026. Essential and important entities have 12 months to implement their obligations, and essential entities have 24 months to complete their first security audit.
Amendment to the KSC Act in force
The provisions implementing the NIS2 Directive apply from this date.
Application for registration
Deadline for applications for entry in the register of essential and important entities (schedule set by the Minister of Digital Affairs).
Today
next deadlineImplementing the requirements
Entities covered by the Act from its entry into force implement their obligations, including the information security management system.
First audit of essential entities
Deadline for the first security audit, followed by audits at least once every 3 years.
03Case studies
Systems delivered to production - from our wider portfolio.
InsurTech · Document AI
A production system for a client in the insurance sector. A dedicated language model extracts data from PDF policies, with no transfer to external AI providers.
Delivered
Consumer AI · Multimodal platform
A commercial AI platform that brings together models from leading providers - native on iOS and Android, in the browser and on Windows, macOS and Linux, localised into 40 languages.
Delivered
04Products
Our own products, currently in development. The same expertise goes straight into our clients' projects.
Cybersecurity · SaaS · Compliance
Takes your organisation through the NIS2 and KSC Act compliance cycle - from scope assessment and gap analysis, through policies and procedures, to reporting incidents to the CSIRT within 24 and 72 hours.
In development
Legal Tech · Neuro-Symbolic AI
Analysis of multi-volume court case files with a local language model fine-tuned on Polish law - the files never leave the law firm's infrastructure.
In development
Enterprise DLP · Zero Trust
Secure access to AI tools at work - data stays on the employee's device, and sensitive content is pseudonymised before it is sent to public models.
In development
05How we work
The same process for a software project and for security testing - only the scope changes.
We learn about your goal, context and constraints. Before any details are exchanged, we sign a non-disclosure agreement.
A discovery workshop for a software project, or agreeing the test scope - systems, environments, test accounts and time windows.
Schedule, cost and measurable acceptance criteria - you know what you will get and when.
We work in stages and report progress regularly. We test only with the written authorisation of the system owner.
Sign-off against the acceptance criteria, a retest of fixes, or deployment and maintenance under an SLA.
We match the billing model to each client - licence, subscription or a hybrid. Every project runs under an NDA, a contract and an SLA with measurable acceptance criteria.
Engagement models06Why Innovix
We build software and test its security ourselves - penetration testing is part of the development lifecycle, not a separate order at the end. We also test and audit systems built by other vendors.
See both service paths.
Every vulnerability comes with technical evidence - the literal output of a command, with no “possibly exploitable” wording. A CVSS 3.1 score with business context, a retest after fixes and a summary for the board.
Penetration testing: OWASP WSTG, PTES and CVSS 3.1.
We keep hosting, databases, model training and logs in EU data centres, with no transfers to third countries. We run language models for businesses in a private cloud in the EU or in the client's own infrastructure.
Examples: Broker-Innovix and LegalAI Analytics.
We take NIS2/KSC, DORA, GDPR and ISO/IEC 27001 into account from requirements analysis onwards, not in end-of-project documents. We map test results to specific regulatory requirements.
See the NIS2/KSC deadlines.
07Insights
DORA
Penetration testing vs TLPT under DORA: tests under Arts. 24-25 vs TLPT under Arts. 26-27, who must run TLPT, how the test works and how to prepare.
Penetration testing
How to compare penetration testing proposals: an RFP checklist, a comparison table, questions to ask the provider and red flags - no guessing based on price.
Software
How to choose a software development company: a printable RFP checklist, a proposal comparison table and questions on security, code ownership and SLAs.
08FAQ
The security audit under the Polish KSC Act assesses whether the information system and security management meet the requirements of the Act. Essential entities must undergo it at least once every 3 years, and it is carried out by qualified, independent auditors. A penetration test is a practical attempt to attack selected systems - it reveals specific vulnerabilities but does not replace the audit. We carry out the Article 15 audit in cooperation with a partner, help organisations prepare for it and run penetration tests.
It depends on the sector listed in the annexes to the Polish KSC Act and on the size of the company, which is generally counted together with linked and partner enterprises in the group - as a rule, the obligations apply to medium-sized and large enterprises, and some entities are covered regardless of size. If you are not sure, we will assess it as part of a gap analysis. Deadlines and the legal basis are in the NIS2/KSC section.
The price of a penetration test depends on the scope: the number of functions and user roles, the number of environments, the test mode (black-box, grey-box, white-box) and the retest after fixes. We prepare an individual quote after a short scoping call and reply within 24 hours on business days.
Yes. Our office is in Wrocław, and we deliver projects and tests for companies across Poland and the European Union. We work in English and Polish.
We agree the copyright model in the contract - from a licence to a full transfer of rights. Every project runs under an NDA, a contract and an SLA with measurable acceptance criteria.
In data centres in the European Union - this covers hosting, databases, model training and logs, with no transfers to third countries. We can run AI models for businesses in your own infrastructure (on-premises) - this is how we design LegalAI Analytics.
Tell us briefly what you need - we reply within 24 hours on business days and propose next steps. We work in English and Polish.
or call +48 575 621 877