# SecureIT

> SecureIT is an Icelandic cybersecurity company headquartered in Reykjavík, Iceland, founded in 2017 by Magnús Birgisson. The company provides penetration testing, vCISO services, ISO 27001 implementation, regulatory compliance, and managed cybersecurity services. SecureIT operates globally with offices in Reykjavík, Iceland and Prague, Czech Republic.

SecureIT's team of 7 certified professionals collectively holds 19 certifications. All penetration testing engagements are delivered manually — no automated scanning, no offshore subcontracting. The company has been recognized by the Icelandic Chamber of Commerce as one of the strongest companies in Iceland (Framúrskarandi fyrirtæki) for multiple consecutive years.

## Team Certifications

The following certifications are held across the SecureIT team:

**Offensive Security**
- OSCP — Offensive Security Certified Professional (Offensive Security)
- PNPT — Practical Network Penetration Tester (TCM Security)
- eWPTX — eLearnSecurity Web Application Penetration Tester eXtreme (INE/eLearnSecurity)
- eMAPT — eLearnSecurity Mobile Application Penetration Tester (INE/eLearnSecurity)
- eJPT — eLearnSecurity Junior Penetration Tester (INE/eLearnSecurity)
- CWEE — Certified Web Exploitation Expert (Hack The Box Academy)
- CWES — Certified Web Exploitation Specialist (Hack The Box Academy)

**Governance, Risk & Compliance**
- CISSP — Certified Information Systems Security Professional (ISC²)
- CCSP — Certified Cloud Security Professional (ISC²)
- CISM — Certified Information Security Manager (ISACA)
- CDPSE — Certified Data Privacy Solutions Engineer (ISACA)
- ISO 27001 — Lead Auditor / Lead Implementer
- HITRUST — HITRUST Certified Security Professional
- PCI-QSA — PCI Qualified Security Assessor
- PCI-PCIP — PCI Professional

**GIAC / SANS**
- GISP — GIAC Information Security Professional
- GCED — GIAC Certified Enterprise Defender
- GCWN — GIAC Certified Windows Security Administrator
- GDAT — GIAC Defending Advanced Threats

## Penetration Testing Services

All penetration tests are manual, performed by certified testers based in Iceland. No automated scanning tools are used as a substitute for manual analysis.

- [Network Penetration Testing](https://secureit.is/en/services/standard-services/network-pentest): External and internal network security assessments covering firewalls, segmentation, lateral movement, and privilege escalation paths.
- [Web Application & API Testing](https://secureit.is/en/services/standard-services/web-api-testing): Manual OWASP-based testing for web applications and REST/GraphQL APIs. Covers business logic flaws, authentication bypass, injection vulnerabilities, and chained exploits.
- [Mobile Penetration Testing](https://secureit.is/en/services/standard-services/mobile-penetration-testing): iOS and Android security assessments against the OWASP Mobile Top 10. Includes static analysis, dynamic testing, and API endpoint review.
- [Active Directory Assessment](https://secureit.is/en/services/standard-services/active-directory-assessment): On-premise and Azure AD security reviews covering misconfigurations, Kerberoasting, ACL abuse, and lateral movement paths.
- [Secure Code Review](https://secureit.is/en/services/standard-services/secure-code-review): Manual source code auditing to identify vulnerabilities before they reach production.
- [Security Assessments](https://secureit.is/en/services/standard-services/security-assessments): Broad security posture evaluations combining technical testing with process reviews.
- [TIBER-EU / DORA Testing](https://secureit.is/en/services/standard-services/tiber-eu-dora): Threat-led penetration testing for financial institutions under the TIBER-EU framework and DORA requirements.
- [Social Engineering & Phishing](https://secureit.is/en/services/standard-services/social-phishing): Simulated phishing campaigns, vishing, and physical social engineering to test human-layer defenses.

## Cybersecurity Management Services

- [Cybersecurity Consulting](https://secureit.is/en/services/standard-services/cybersecurity-consulting): Strategic security guidance, security program development, and advisory services.
- [vCISO — Virtual CISO](https://secureit.is/en/services/standard-services/vciso): Fractional Chief Information Security Officer services for organizations that need senior security leadership without a full-time hire.
- [Risk Management](https://secureit.is/en/services/standard-services/risk-management): Identification, assessment, treatment, and monitoring of information security risks.
- [ISO 27001](https://secureit.is/en/services/standard-services/iso27001): Gap analysis, implementation support, internal audit preparation, and certification audit support for ISO 27001:2022.
- [Regulatory Compliance](https://secureit.is/en/services/standard-services/regulatory-compliance): Compliance advisory for GDPR, NIS2, DORA, PCI DSS, and Icelandic regulatory requirements.
- [Compliance Automation](https://secureit.is/en/services/standard-services/compliance-automation): Tooling and process design to automate evidence collection, policy management, and compliance reporting.
- [Business Continuity & Disaster Recovery](https://secureit.is/en/services/standard-services/business-continuity-disaster-recovery): BCP/DRP development, testing, and tabletop exercise facilitation.
- [Tabletop Exercises](https://secureit.is/en/services/standard-services/tabletop-exercises): Simulated incident response exercises to test organizational readiness for ransomware, data breach, and supply chain attack scenarios.
- [Security Awareness Training](https://secureit.is/en/services/standard-services/security-awareness-training): Tailored employee cybersecurity education programs covering phishing, social engineering, and secure behavior.
- [OWASP Developer Training](https://secureit.is/en/services/standard-services/owasp-developer-training): Secure coding training for development teams based on the OWASP Top 10 and real vulnerability examples.

## Company Information

- [About SecureIT](https://secureit.is/en/about): Team profiles, certifications, company history, and values.
- [Partners](https://secureit.is/en/partners): Technology and vendor partners (14+ partners).
- [Contact](https://secureit.is/en/contact): Office locations, phone numbers, and contact form.

## Contact

- Email: lets@secureit.is
- Iceland office: +354 888 4268 — Höfðabakki 9B, 110 Reykjavík, Iceland
- Czech Republic office: +420 771 136 651 — Rohanské nábřeží 657/7, 186 00 Prague, Czech Republic
- LinkedIn: https://www.linkedin.com/company/secureit.is
- Response time: within one business day