Cybersecurity Services · Florence, Italy

Cybersecurity
& Penetration Testing
by Builders

Since 2010 we have shipped 100+ apps, web platforms and cloud backends, so we know exactly where they break. Penetration testing, mobile app security, NIS2 and GDPR compliance and DevSecOps, from engineers who also fix what they find.

Request an assessment

What We Secure

Four practices, one team.
01

Mobile App Security

iOS and Android apps, tested the way an attacker would.

Security reviews and penetration tests for iOS and Android apps against OWASP MASVS and MASTG: insecure data storage, weak authentication, broken certificate pinning, hardcoded API keys, reverse engineering and tampering. We have built 100+ native apps, so we read your code the way your developers wrote it.

  • Static and dynamic analysis (SAST / DAST)
  • Jailbreak, root, tampering and reverse engineering tests
  • Backend and API testing behind the app
  • Secure code review for Swift, Kotlin, Flutter and React Native
02

Penetration Testing & VAPT

Find the holes before someone else does.

Vulnerability assessment and penetration testing (VAPT) for web applications, APIs, cloud environments and network perimeters. Automated scanning plus manual exploitation following OWASP WSTG and PTES, with every finding scored by CVSS, ranked by business risk and backed by reproducible evidence.

  • Web application and API penetration testing
  • External and internal network VAPT
  • Black box, grey box and white box testing
  • Retest after remediation
03

NIS2, GDPR & DORA Compliance

From legal requirement to working controls.

Gap analysis and remediation roadmaps for NIS2 (in Italy, Legislative Decree 138/2024), GDPR security of processing (Art. 32) and DORA ICT risk management. We turn regulation into concrete technical measures: asset inventory, risk assessment, incident response, supplier security and the evidence auditors ask for.

  • NIS2 gap analysis and ACN registration support
  • Security policies and incident response plans
  • Privacy and security by design for apps (GDPR)
  • Supply chain and third-party risk
04

Cloud Security & DevSecOps

Security built into the pipeline, not bolted on.

Hardening for AWS, GCP, Firebase and Kubernetes, plus security gates inside your CI/CD: dependency and container scanning, secrets management, infrastructure-as-code review and least-privilege IAM. The same stack we use to run production systems for our own products.

  • Cloud configuration review (CIS Benchmarks)
  • CI/CD security gates: SAST, SCA, secret scanning
  • Kubernetes and container hardening
  • Logging, monitoring and alerting

How We Work

Clear scope, clear report.

  1. 01 · Scope

    A scoping call to define targets, rules of engagement and testing windows. NDA signed before any access.

  2. 02 · Assess

    Automated scanning plus manual testing by our engineers, with production-safe methods coordinated with your team.

  3. 03 · Report

    An executive summary for management and a technical report for developers: every finding with severity, evidence and a step-by-step fix.

  4. 04 · Fix & Retest

    Our engineers can implement the fixes directly in your codebase. Then we retest and confirm every issue is closed.

Why APPSTYX

Builders who break things.

Most security firms hand you a PDF and leave. We have been building software since 2010, so we hand you the fix.

APPSTYX is a software house in Florence, Italy. Our engineers design and ship native iOS and Android apps, web platforms and cloud backends for enterprises, retailers and public institutions. That is why our security work is practical: we know how real codebases are built, where shortcuts hide, and how to close a vulnerability without breaking the product.

Assessments, compliance roadmaps and remediation come from the same team, in English or Italian, remotely across Europe or on site in Tuscany. Looking for app development instead? See our development services.

15+ Years Building Software
100+ Apps Shipped
500M+ Users Reached

Standards We Follow

Recognised methods, auditable results.

Mobile

  • OWASP MASVS
  • OWASP MASTG
  • OWASP Mobile Top 10
  • Apple & Android platform security

Web & API

  • OWASP Top 10
  • OWASP WSTG
  • OWASP ASVS
  • OWASP API Security Top 10

Frameworks

  • NIST CSF 2.0
  • ISO/IEC 27001 controls
  • CIS Controls & Benchmarks
  • PTES

Regulation

  • NIS2 · D.Lgs. 138/2024
  • GDPR
  • DORA
  • Cyber Resilience Act (CRA)

Questions

Straight answers.
What is the difference between a vulnerability assessment and a penetration test?

A vulnerability assessment maps known weaknesses across your systems, mostly with automated tools. A penetration test goes further: engineers actively exploit those weaknesses, chain them together and show what an attacker could actually reach. Most organisations need both, which is why we deliver them together as VAPT.

How much does a penetration test cost?

It depends on scope: the number of apps, APIs, hosts and user roles, and whether testing is black, grey or white box. After a short scoping call we send a detailed quote.

Does NIS2 apply to my company?

NIS2 generally covers medium and large organisations (roughly 50+ employees or more than 10 million euro in turnover) in the sectors listed by the directive, such as energy, transport, health, digital infrastructure, ICT services, manufacturing and food. In Italy it was transposed by Legislative Decree 138/2024 and in-scope entities must register with the National Cybersecurity Agency (ACN). Smaller companies are often affected indirectly as suppliers of NIS2 entities.

Do you test both iOS and Android apps?

Yes. We test native Swift and Kotlin apps as well as Flutter and React Native builds, covering data storage, network communication, authentication, cryptography, platform interaction, code resilience and the backend APIs the app relies on, following OWASP MASVS.

Can you fix the vulnerabilities you find?

Yes. Our team builds mobile apps, web platforms and cloud infrastructure every day, so we can implement the fixes ourselves or work alongside your developers, then retest to confirm each issue is closed.

Do you only work with companies in Florence?

No. We are based in Sesto Fiorentino, Florence, and work with clients across Italy, Europe and worldwide. Most assessments run remotely; on-site activities are available in Tuscany and across Italy.

Let's Talk Security

Tell us what to protect.

Email

[email protected]

Location

Via San Morese 9, 50019
Sesto Fiorentino (FI) Italy