Cybersecurity · SMEs and mid-sized companies
Cybersecurity for SMEs and mid-sized companies: protecting your applications, servers and cloud every day
AXELITES, an IT services company with offices in Paris, Montréal and Tunis, takes care of the operational security of applications, servers and cloud environments for SMEs and mid-sized companies: patches and vulnerability monitoring, firewalls and WAF, hardening, access management and MFA, backups and disaster recovery, code audits, an in-house SOC with 24/7 monitoring and managed EDR/XDR. The teams that build and maintain your applications apply security where the flaws are, in the code as well as in the infrastructure.
Security kept up, not just announced
What we take care of:
- 24/7 SOC monitoring
- Managed EDR and XDR
- Security patches
- CVE monitoring
- Network firewalls
- WAF
- Server hardening
- AWS and Azure security
- MFA, passkeys, FIDO2
- Backups
- Disaster recovery
- Code audits
Security is not a yearly audit.
The security of an SME is not decided by a yearly audit, but by repeated actions: installing a published patch, closing a forgotten port, removing access nobody needs any more, checking that a backup can be restored. Since 2012 and more than 300 projects, we keep these actions going over time, with a written scope that also states what we do not do.
Security left to chance
- Patches installed whenever someone remembers
- Shared accounts and former contractors’ access still active
- A single password to get into the cloud console
- Backups never restored
- A flaw discovered by a customer, or by an attacker
AXELITES cybersecurity
- CVE monitoring and patches prioritised by exposure
- Named access, reviewed and removed in time
- MFA and passkeys on sensitive access
- Tested backups and a documented recovery plan
- Code audits and monitoring that spot flaws earlier
Security building blocks run by the team that knows your applications
Six areas handled by the teams that build, host and maintain applications, under the 24/7 watch of our in-house SOC.
Patches and vulnerability monitoring
Operating system, web servers, databases, CMS, frameworks and dependencies: we follow the CVEs that affect your components and install patches according to their severity and exposure.
- Inventory of components and versions
- Targeted CVE monitoring
- Prioritised patches
- Prior backup and rollback
Firewall and WAF
The firewall closes unnecessary ports and addresses; the WAF filters requests aimed at your websites and APIs. We configure and administer both, and review the rules with every change.
- Firewall rules kept to what is needed
- A WAF in front of websites and APIs
- Rate limiting on login attempts
- Filtering tuned so customers are not blocked
Server and cloud hardening
Unused services removed, administrative access restricted, traffic encrypted, logging enabled; in the cloud, the identities, networks and storage of your AWS or Azure accounts reviewed and corrected.
- Default configuration tightened
- Administrative access logged
- AWS and Azure accounts reviewed
- Activity logs retained
Access, MFA and passkeys
Named accounts, permissions limited to each person’s needs, MFA on sensitive access and, where your tools allow, passkeys or FIDO2 keys, which resist phishing.
- Named accounts
- Permissions limited to actual needs
- MFA, passkeys and FIDO2 keys
- Unneeded access removed
Backups and disaster recovery
Recovery objectives defined with you, copies outside the main site, tested restores and a documented recovery plan: a backup only counts if it can be restored.
- RPO and RTO defined with you
- Copies outside the main site
- Regular restore tests
- Documented recovery plan
Application security audit
A review of the source code, dependencies and configuration against the OWASP Top 10, with flaws ranked by severity and proposed fixes. It is not a PASSI-qualified penetration test.
- Code and access controls
- Vulnerable dependencies
- Application and server configuration
- Proposed fixes
From a published vulnerability to a patched system
Patch management is a process, not a one-off: every published flaw is checked against your components, then handled in order of priority.
Publication
A flaw is published with its CVE identifier and severity. Our monitoring matches it against the inventory of your components.
Stage: MonitoringAssessment
Is the component present, in which version, exposed to the internet? Only the flaws that affect you lead to action.
Stage: AnalysisPrioritisation
Severity, exposure and known exploitation set the order: an exposed service comes before an internal tool.
Stage: DecisionPreparation
A backup is taken and the rollback prepared. When a stopgap is possible, such as a WAF rule, it protects the service until the patch.
Stage: BackupInstallation
The patch is installed, services restarted and the main user journeys checked.
Stage: ReleaseCheck
The patched version is confirmed and the action recorded, so you always know where your components stand.
Stage: Follow-up
What we take care of, and what belongs to a specialised provider
Some security services require a qualification or a certification process. We would rather say so plainly.
Swipe to see more
| Need | AXELITES cybersecurityThe team that knows your applications | Specialised providerQualified pentest, certification, compliance |
|---|---|---|
| Security patches and CVE monitoring | Included | Not needed |
| Firewall and WAF configuration and administration | Included | Not needed |
| Hardening of servers and cloud accounts | Included | Not needed |
| Access management, MFA, passkeys and FIDO2 keys | Included | Not needed |
| Backups, restore tests and disaster recovery | Included | Not needed |
| Audit of code, dependencies and configuration | Included | Not needed |
| In-house SOC and 24/7 monitoring | Included | Not needed |
| Managed EDR or XDR | Included | Not needed |
| Incident response during business hours | Included | Not needed |
| PASSI-qualified penetration test | Not offered | Required |
| ISO 27001 certification, NIS2 compliance | Not offered | Required |
Good to know: our teams can fix the flaws found by a penetration test in the code and environments they maintain. Let’s talk about your project
Security patches and vulnerability monitoring (CVE)
A published vulnerability receives a CVE identifier (Common Vulnerabilities and Exposures) and becomes known to defenders and attackers alike. The time between its publication and the installation of the patch is the period during which your systems remain exposed.
We keep an inventory of the components in your environments (operating system, web servers, databases, CMS and frameworks, application dependencies) and monitor the vulnerabilities that affect them. Each patch is prioritised according to the severity of the flaw and the exposure of the component, then installed with a prior backup and a rollback plan.
- Inventory of components and their versions
- CVE monitoring for the components you use
- Patches prioritised by severity and exposure
- Prior backup and rollback plan
Firewall and WAF: filtering traffic before it reaches your applications
A network firewall limits the ports and addresses allowed to reach your servers. A web application firewall (WAF) inspects HTTP requests and blocks known attack patterns, such as SQL injection or repeated attempts on login forms. The two work together: one closes the doors you do not need, the other watches the ones that must stay open.
We configure and administer the rules of your firewalls and WAF, tune the filtering so that your customers are not blocked, and review the rules as your applications change. A rule that no longer serves a purpose is removed.
- Only the ports and addresses that are needed
- A WAF in front of your websites and APIs
- Rate limiting on login attempts
- Rules reviewed with every change
Hardening servers and cloud environments
A server installed with its default settings exposes more services, accounts and permissions than it needs. Hardening means removing what is not used and tightening the rest: unnecessary services disabled, administrative access restricted, traffic encrypted, logging enabled.
In the cloud, security also depends on configuration: a storage bucket open to the public, an access key left in a code repository or an administrator account used for everyday work is enough to create a breach. We review and correct the configuration of your AWS or Azure accounts: identities and roles, networks, storage and activity logs.
- Unused services and accounts removed
- Administrative access restricted and logged
- AWS and Azure accounts reviewed: identities, networks, storage
- Activity logs enabled and retained
Access management, MFA and passkeys (FIDO2)
A stolen or reused password can be enough to open an administration console. Multi-factor authentication (MFA) adds a second proof. Passkeys and FIDO2 security keys go further: bound to the site on which they were created, they cannot be used on a fake login page, which makes them resistant to phishing.
We set up named accounts, permissions limited to what each person needs, MFA on sensitive access and, where your tools support them, passkeys or FIDO2 keys. Access held by former employees and contractors is reviewed and removed.
- Named accounts, no shared credentials
- Permissions limited to actual needs
- MFA, passkeys and FIDO2 keys
- Access reviews and removal of unused accounts
Backups and disaster recovery plan
A backup is only worth something if it can be restored. Against ransomware, a backup reachable from the same network can be encrypted along with the data it protects: the copy must be kept apart, and the restore verified.
We define your recovery objectives with you, the RPO (acceptable data loss) and the RTO (acceptable downtime), set up copies outside the main site, test restores and document the disaster recovery plan.
- RPO and RTO defined with you
- Copies outside the main site
- Regular restore tests
- Documented disaster recovery plan
Application security audit: code, dependencies and configuration
The OWASP Top 10 lists the most critical security risks for web applications: broken access control, injection, misconfiguration, vulnerable components, weak authentication. These flaws sit in the code and its configuration, where an external scanner cannot always see.
Our audit covers the source code, the dependencies and the configuration of the application and its server, against the OWASP Top 10. It results in a list of flaws ranked by severity, with proposed fixes. It is not a penetration test: if your context requires a pentest by a PASSI-qualified provider, we tell you so.
- Review of the code and access controls
- Dependencies and vulnerable components
- Application and server configuration
- Flaws ranked by severity, fixes proposed
24/7 SOC monitoring, EDR/XDR and incident response
Our SOC, run by AXELITES’ own teams, monitors your servers, workstations and applications 24/7: availability, errors, logs, certificates and suspicious behaviour. We also deploy and run managed EDR and XDR solutions, which detect threats on workstations and servers and correlate the signals. Incident response takes place during business hours: we isolate the affected system, fix it, restore if necessary and analyse the cause so that it does not happen again.
We do not offer PASSI-qualified penetration testing, or support for ISO 27001 certification or NIS2 compliance. If your organisation needs them, these services belong to qualified or specialised providers: we would rather say so from the first conversation.
- In-house SOC and 24/7 monitoring
- Managed EDR and XDR
- Response during business hours: isolation, fix, restore
- Root-cause analysis after each incident
Why entrust your cybersecurity to AXELITES
The same team for the code and the infrastructure
A flaw is sometimes fixed in the code, sometimes in the server configuration. Our teams build, host and maintain applications: they work on both sides.
A clearly stated scope
We say what we do and what we do not: no PASSI pentest or certification support hinted at. You know what is covered, and what should be entrusted elsewhere.
Measures sized for SMEs and mid-sized companies
Priorities follow the actual exposure of your systems and your budget: patches, access and backups first, the rest afterwards.
An IT services company in Paris, Montréal and Tunis
You work with a company present in three offices since 2012, and with a contact who knows your applications.
How we move forward together
Assess the current state
Applications, servers, cloud accounts, access and backups: we take stock of what exists and identify the most urgent exposures.
Fix the most urgent
Overdue patches, excessive access, open ports, backups never restored: the priority risks are dealt with first.
Put the protections in place
Firewalls and WAF, hardening, MFA and passkeys, EDR and XDR, backups and disaster recovery: each measure is configured, tested and documented.
Keep it up over time
CVE monitoring, patches, access reviews, restore tests and monitoring become regular routines.
An assessment, priorities and measures documented, then kept up over time.
A SOC that watches your systems 24/7.
Our SOC, run by AXELITES’ own teams, monitors your servers, workstations and applications around the clock, with managed EDR and XDR solutions. When an incident occurs, we respond during business hours: isolation, fix, restore if necessary and root-cause analysis. Alongside, these checks come back regularly.
- Patches available for your components
- Unused or excessive access
- Successful backups and tested restores
- Firewall and WAF rules up to date
- TLS certificates before expiry
AureliaWatch, AI-assisted monitoring
Developed by AXELITES, AureliaWatch analyses logs, detects anomalies and flags suspicious behaviour to help you act before an incident spreads.
Discover the Aurelia suiteOur security guides
Phishing aimed at cloud consoles, attacks that start with an email, security built in from the design stage: what we explain to our clients.
Your questions, our answers
Practical answers to help you make the right decisions before starting your project.
Discuss my projectIt is the set of measures that protect your applications, servers, accounts and data against attacks and loss. For an SME or mid-sized company, the essentials come down to concrete, repeated actions: installing patches, filtering traffic, hardening servers and the cloud, protecting access with MFA, backing up and testing restores, auditing code and monitoring.
Eight building blocks: installing security patches and monitoring vulnerabilities (CVE), configuring and administering firewalls and the WAF, hardening servers and the cloud, access management and MFA (including passkeys and FIDO2 keys), backups and disaster recovery, application security audits (code, dependencies, configuration), 24/7 monitoring by our in-house SOC with managed EDR and XDR solutions, and incident response during business hours.
With an assessment: which applications, which servers, which accounts, which backups. Then come the measures that reduce risk the most: overdue patches, MFA on administrative access, removal of unused accounts and a restore test of the backups. Filtering, hardening and code audits complete this foundation.
Yes. Our SOC, run by AXELITES’ own teams, monitors your servers, workstations and applications 24/7, and we deploy and run managed EDR and XDR solutions. Incident response (isolation, fix, restore) takes place during business hours.
No. Some of the technical measures we implement, such as vulnerability handling, backups and disaster recovery, or multi-factor authentication, are among those listed in Article 21 of the NIS2 Directive. Putting them in place does not amount to compliance, however: that is a governance process led by your organisation, with specialised advice.
Using three criteria: the severity of the vulnerability, the exposure of the affected component (can it be reached from the internet?) and whether it is known to be exploited. A critical patch on an exposed service comes before a minor update to an internal tool. Each patch is installed after a backup, with a rollback plan.
A WAF (web application firewall) sits in front of your websites and APIs. It inspects requests and blocks known attack patterns, such as injection or repeated login attempts. It is useful as soon as an application is exposed on the internet, especially an online store or a customer portal; it complements fixing flaws rather than replacing it.
A code sent by SMS can be intercepted, or typed by the user into a fake login page and replayed by the attacker. A passkey or FIDO2 key is bound to the site that created it: it does not work on a phishing site. We set it up on sensitive access where your tools support it, and standard MFA elsewhere.
A backup is a copy of your data. A disaster recovery plan describes how to bring your services back after an incident: in what order, how quickly (RTO), with how much acceptable data loss (RPO) and who does what. Without restore tests, neither can be relied on.
No, it is complementary. Our audit examines the source code, dependencies and configuration against the OWASP Top 10, which reveals flaws that a test from the outside cannot always see. A penetration test simulates a real attack; if it must be PASSI-qualified, it belongs to a provider qualified by ANSSI, the French cybersecurity agency. Our teams can then fix the flaws it finds in the code they maintain.
Let’s talk about the security of your applications and servers
Describe your applications, your hosting and what worries you: we will propose an assessment and the first measures to take.