Cybersecurity, CreateIT
Cybersecurity for businesses
A list of the tools you have in place is not enough to assess your cybersecurity. You have to test how your systems, access, configuration, people and response processes hold up against realistic attack scenarios. CreateIT runs security assessments to a clear scope and rules agreed with you, and backs the results with evidence. You come away with prioritised findings and a practical basis for reducing risk.
2012
founded in Riga
5
types of security assessment
7
service areas
Our cybersecurity services
Malware removal and recovery after an attackIf a website or system has been hacked or infected, we contain the damage, remove the malicious code, find the vulnerability the attacker used and restore operations safely. In urgent cases we also help in the evenings and at weekends.
Security auditWe carry out a structured assessment of your systems, configuration, access, vulnerability management, backups, logging and any other security controls in scope. You get evidence-based findings and a prioritised improvement plan.
Penetration testingWith written authorisation and a scope defined in advance, we actively look for vulnerabilities in web applications, APIs, external or internal infrastructure and other agreed targets. Where it is safe and necessary, we validate a vulnerability in practice to distinguish a theoretical finding from one that can genuinely be exploited.
Social engineeringUsing scenarios agreed with you, we test your organisation's resilience to phishing and other methods that exploit people's trust. The aim is to measure how effective your processes and controls are, identify risks and improve how employees respond - not to find someone to blame.
Assumed breach testingWe begin from an agreed starting point in your internal environment and test which privileges, systems and data become reachable from there. This helps you assess your segmentation, identity security and privilege escalation risks, and how well your defences spot suspicious activity.
Attack simulationDepending on the objective, we design technical attack simulations or incident scenarios for tabletop exercises. They go beyond a single vulnerability to test detection, escalation, decision-making, communication and the response process.
How we run security assessments
Authorisation and scope first
Before any active testing begins, we set out in writing the objectives, the systems to be tested, the permitted and prohibited actions, the testing windows, the points of contact and the procedure if an incident occurs. We work only within the agreed scope.
Evidence, not just scanner output
Automated tools help to flag potential issues, but we validate and document the significant findings. The report includes context, evidence, potential impact, risk priority and recommendations for your technical team, as well as a summary management can follow.
Confidentiality
Before work starts, we agree the access arrangements, how sensitive data will be handled, how reports will be handed over and who the points of contact are. We use information obtained during testing only for the agreed work and protect it according to how sensitive it is.
Priorities and retesting
We rank findings by risk and context, so that your team can start with what matters most. Once the fixes are in place, we can retest the specific findings and document whether the risk originally identified has been remediated.
Where to start?
If you need an overall picture of your security controls and priorities, a security audit can be your starting point. If the question is specific - for example, whether your public-facing application, API or infrastructure can be compromised in practice - a penetration test is the better fit. If you want to test what happens after initial access, or how well your team spots and handles an attack, we opt for an assumed breach or attack simulation scenario.
Before we prepare a proposal, we find out what you want to prove or test. That lets us choose the method to fit the risk and the objective, rather than sell you the broadest test.
Frequently asked questions
Are the tests safe for live systems?
Active security testing always carries some risk, so it cannot honestly be called completely safe. Before work starts, we assess how critical the system is and agree the permitted methods, testing windows, points of contact and stop conditions. We test a live production environment only if it is justified and the risk has been accepted; we do not carry out destructive or particularly risky actions without separate approval.
Do we need cybersecurity if we are a small business?
The size of a business does not in itself determine the risk. What matters is which systems and data you have, how much you depend on them being available, what access is in place and what the consequences of an incident would be. For a smaller business, the assessment can focus on the most important assets and the most likely risks.
What is the difference between an audit, a penetration test and a simulation?
An audit assesses the security controls in scope and how they have been implemented. A penetration test actively looks for exploitable vulnerabilities within a defined technical scope and, where permitted, validates them. An attack simulation focuses on a specific adversary scenario or on testing defensive capabilities, including detection and response. The three answer different questions and do not have to be done in a set order.
What do we get at the end of the engagement?
You get a report setting out the scope and approach of the assessment, the findings, the evidence, an explanation of risk and impact, and recommendations for remediation. We talk the results through with the people responsible on your side. If it is part of the engagement, we retest the specific findings once the fixes are in place.
Do the NIS2 requirements apply to us?
The EU NIS2 Directive, transposed in Latvia by the National Cybersecurity Law, applies to companies and public bodies in specified sectors that meet its criteria. They must manage cybersecurity risks and assess how effective their security measures are. We help with the technical checks - a cybersecurity audit and penetration testing, while whether the rules apply to you is determined by the criteria in your country's law.
Do you carry out IT security testing for companies outside Latvia?
Yes. Most testing can be done remotely, and we prepare reports in English or Latvian. The scope of the test, the authorisations and the applicable requirements are agreed in writing with each client before work begins.
For every project -
a clear rationale.
Discovery, Decisions, Delivery, Accountability
2012
Founded in Riga
1 working day
Response time
100%
Code remains with the client
7
Service areas
Portfolio
Work we can talk about.
Clients
Organisations we have worked with.
Experience across central and local government, international organisations and the private sector.
Client references
Working with us, in our clients' words.
References from organisations we have worked with on development, maintenance and digital communication projects. Translated from the Latvian original.
During our work together, the websites were maintained, unexpected operational problems were dealt with and recommendations were made on security and speed. The work was done well and on schedule.
The service was provided on time and to a high standard. During the maintenance period, technical shortcomings were remedied, improvements were made, new functionality was implemented and existing modules were developed further.
Development and maintenance of the website were delivered on time and to a high standard, in line with the contract requirements. The organisation recommends CreateIT as an IT service provider.
Contact
Which service suits your business?
Tell us in a few sentences what is worrying you or what you want to test. We will recommend where to start and give you the scope, timeline and price within one working day.
1 working day
response time
5
types of security assessment
2012
founded in Riga