Italiano
English
Español
Português
Deutsch
Français
Cyber Security
Cybersecurity
Security audits, risk assessments, NIS2 compliance and ongoing protection: safeguarding your company’s data, systems and operations.
Cybersecurity is no longer just a technical issue: it is a business responsibility and, under the NIS2 Directive, a legal obligation for many organisations. We support you throughout the process: from the initial audit and risk assessment to compliance procedures, ongoing protection and monitoring.
One partner to assess risks, secure networks, servers, cloud services and applications, prepare the required documentation and respond to incidents when they occur.
Governance
Audits, risk and compliance
Security audits
A comprehensive overview of your security posture: infrastructure, configuration, access, backups, procedures and suppliers, with a clear report outlining priorities.
Risk assessment
We identify assets and threats, assess likelihood and impact, and establish a practical risk treatment plan for your business.
NIS2 and ISO/IEC 27001 gap analysis
We compare your current position against NIS2 requirements and the ISO/IEC 27001 standard to identify gaps and prioritise improvements.
Policies and procedures
We develop security policies, access, backup and password management procedures, and incident management and notification processes.
Business continuity
Tested business continuity and disaster recovery plans to help you recover quickly after an outage or attack.
Supplier security
Assessment of ICT suppliers and the supply chain, one of the most sensitive areas covered by NIS2.
Compliance with the NIS2 Directive
The European NIS2 Directive, transposed into Italian law through Legislative Decree 138/2024, significantly expands the number of businesses required to maintain an appropriate level of cybersecurity. It covers medium-sized and large organisations operating in sectors considered essential or important (energy, transport, healthcare, digital services, manufacturing, waste management, food, postal services and many others), as well as their suppliers indirectly.
Organisations within its scope must, among other things:
register on the Italian National Cybersecurity Agency (ACN) platform and update their details annually;
implement proportionate technical and organisational risk-management measures;
report significant incidents within strict deadlines: an early warning within 24 hours, a notification within 72 hours and a final report within one month;
involve their management bodies, which must approve the measures, assume responsibility for them and undergo specific training.
Failure to comply can result in substantial penalties, up to €10 million or 2% of worldwide turnover for essential entities. We help you establish whether NIS2 applies to your business and put everything required in place, step by step: assessments, safeguards, procedures and documentation.
Analysis
Prevention and technical assessment
Vulnerability assessment
Regular scans of networks, servers and exposed services to identify known vulnerabilities.
Penetration testing
We simulate real-world attacks to test how resilient your defences are and identify potential weaknesses.
Application security
Security testing for websites, web applications and mobile apps against attacks such as XSS and SQL injection.
Vulnerability management
Ongoing software and operating system updates, with security vulnerabilities remediated in priority order.
Defence
Protection
Network security
Next-generation firewalls, VPNs for remote connections and segmentation of critical resources.
Cloud security
Secure configurations and dedicated controls for cloud-based data and applications.
Data protection
Encryption and immutable backups to protect data against unauthorised access and ransomware.
Malware protection
Prevention, detection and removal of viruses, ransomware and spyware across every device.
Identity and access management
Multi-factor authentication and least-privilege access: only authorised personnel can access critical data.
Email security
Filtering and configuration (SPF, DKIM, DMARC) to counter phishing, spoofing and malicious attachments.
Monitoring
Monitoring, response and training
Continuous monitoring
Monitoring of networks and systems to detect threats and respond promptly.
SIEM systems
Real-time collection and correlation of security events, with automated responses.
Incident response
Containment, investigation and recovery, including support with mandatory notifications to authorities.
Training and phishing simulations
Training for employees and administrators, plus simulated phishing campaigns to reduce human risk.
Google Cybersecurity Certifications
Alongside their hands-on experience, Leonardo Network's cybersecurity specialists have achieved the following Google certifications:
Foundations of Cybersecurity
Play It Safe: Manage Security Risks
Connect and Protect: Networks and Network Security
Tools of the Trade: Linux and SQL
Assets, Threats, and Vulnerabilities
Sound the Alarm: Detection and Response
Automate Cybersecurity Tasks with Python
Put It to Work: Prepare for Cybersecurity Jobs
Why choose Leonardo Network
From planning to practice: we go beyond documentation to secure networks, servers and applications in practice.
A complete perspective: we manage networks, servers, cloud infrastructure and software ourselves, so we understand every layer of your systems.
Clear communication: reports and priorities that management can understand, not just technical staff.
Ongoing protection: security is not a one-off job but a process we manage over time.
FAQ
Frequently asked questions
It depends on your sector and company size. Generally, medium-sized and large organisations in the sectors covered by the legislation are affected, although smaller companies may also be included in certain circumstances. Even if NIS2 does not apply directly to you, customers subject to it may require security assurances from you as a supplier. We can assess your position with you.
We act to contain the attack, investigate its causes and restore systems. If NIS2 applies to your organisation, we also assist with mandatory notifications: an early warning within 24 hours, notification within 72 hours and a final report within one month.
A vulnerability assessment identifies known system vulnerabilities on a broad, regular basis. A penetration test goes further, simulating a real attack to determine whether and how those weaknesses could be exploited. The two approaches complement each other.
At least once a year, and whenever there is a significant change, such as new systems, cloud migrations, new suppliers or a security incident.
Start with an initial audit: we will quickly give you a clear picture of the main risks and priorities, together with a practical action plan for your company.
The process
From initial assessment to ongoing security.
-
Audit
We assess infrastructure, access, procedures and suppliers.
-
Risk assessment
We assess risks and impacts and set priorities.
-
Plan and procedures
Technical measures, policies and documentation for NIS2.
-
Security implementation
We implement improvements across networks, systems and applications.
-
Monitoring
Continuous monitoring, regular testing and incident response.
CONTACT
Let's talk about Cybersecurity.
- Opening hours
- Mon–Fri 9:00–13:00 | 14:00–18:00 (CET)