Security assessment
We test networks, applications and cloud accounts the way an intruder would, then hand you a report you can act on — ranked by impact, not volume.
- External and internal testing
- Web and API review
- Cloud configuration audit
Security engineering · Zagreb, HR
Threat detection, defensive architecture & incident response.
We help mid-sized companies, public bodies and infrastructure operators across Croatia and the wider region keep critical systems running when something goes wrong — and long before it does.
11years operating
240+environments assessed
24/7monitoring coverage
What we do
Security work that holds up under pressure.
Four practices, one team. We map where you are exposed, build the defences that close those gaps, and stay on call when an alert turns into a real event.
Defensive architecture
Segmentation, identity, logging and encryption designed for how your teams actually work. We document every decision so your engineers can maintain it without us.
- Zero-trust network design
- Identity and access policy
- Data protection controls
Detection & monitoring
A monitoring stack tuned to your environment, with alerts that mean something. Analysts watch the signals so your people are not chasing noise at 3am.
- SIEM build and tuning
- 24/7 analyst coverage
- Threat intelligence feeds
Incident response
When an event is confirmed, a named team takes the call within the hour. We contain, investigate, restore service and write up exactly what happened.
- Containment and recovery
- Forensic investigation
- Regulatory reporting support
Compliance readiness
NIS2, GDPR and ISO 27001 mapped to controls you can demonstrate. We prepare the evidence and sit beside you through the audit.
- NIS2 gap analysis
- ISO 27001 preparation
- GDPR data mapping
Security training
Practical sessions for the people who click the links and approve the payments. Scenario-based, in Croatian or English, measured against real outcomes.
- Staff awareness programmes
- Tabletop exercises
- Developer secure-coding labs
Recent engagements
A few of the problems we have worked through.
Client names stay private — that is part of the work. The situations below are representative engagements from the last three years.
Energy sector
Detection rebuild for a regional utility
Replaced a noisy alerting setup with a tuned SIEM. Median time to triage an alert dropped from 40 minutes to under 6.
Financial services
Cloud segmentation for a payments firm
Redesigned account boundaries and identity policy ahead of a regulatory review. The audit closed with no major findings.
Public sector
Incident response for a city authority
Contained an active intrusion over a weekend, restored services by Monday, and delivered the regulatory report within the legal window.
Security is not a product you install once. It is a practice you keep — quiet, documented, and ready for the day the alarm is real.
— The Digitalnival working principleHow an engagement runs
Clear stages, no surprises.
01
Scoping
We sit down with your team to understand the systems that matter, the obligations you carry, and what a bad day actually looks like for you.
02
Assessment
We examine the environment in depth — configurations, access, traffic and code — and document where the real exposure sits.
03
Remediation
We work alongside your engineers to close gaps in priority order, building defences your team can own and maintain afterwards.
04
Monitoring & review
Detection goes live, analysts take over the watch, and we meet on a fixed cadence to review what the signals are telling us.
6 minmedian alert triage
< 60 minresponse call-out
240+environments assessed
11 yrsoperating from Zagreb
The people you work with
A small bench of senior practitioners.
No layered account managers. The engineer who scopes your work is the one who carries the pager.
Luka Kovačević
Lead, offensive testing
Fifteen years breaking into systems on request, most recently across the energy and telecom sectors. Writes the report you can hand to a board.
Ivana Marić
Lead, detection engineering
Builds the monitoring that catches the quiet events. Spent six years in a national response team before joining the studio.
Domagoj Horvat
Lead, compliance & advisory
Translates NIS2 and ISO 27001 into controls auditors accept. Sits with clients through every assessment from first meeting to sign-off.
Tell us what keeps you up at night.
A short call is enough for us to understand your environment and say honestly whether we are the right team for it.