Logisek

Logisek Stay one step ahead in the digital era with our professional Cyber security and IT Services

Logisek is a leading Cyber Security and IT services firm that was founded in Greece in 2008 and in Romania in 2019 and has since expanded to serve clients on a global scale. With nearly two decades of experience in this field, we specialize in providing comprehensive technological solutions aimed at helping businesses stay secure in the digital world. Our specialized team is committed to maintaini

ng its pioneering position in a constantly changing technological environment, offering our clients the best possible protection against cyber threats. Whether you're seeking cyber security assessments, managed IT services, or cloud solutions, we have the experience needed to support you in achieving your goals. Secure your digital future with the trusted Cyber Security and IT solutions we provide. CONTACT
Stay up to date with Logisek and follow the latest security and IT trends by following our official pages on:

⇢ LinkedIn: /logisek
⇢ Twitter - X: /logisekict
⇢ GitHub: /Logisek
⇢ Instagram: /logisek_ict

_______
✉ [email protected]
☎+30 21 0662 6841

Your Most Internet-Facing Device May Not Run Windows against systems across at least 12 U.S. states are a reminder ...
13/08/2026

Your Most Internet-Facing Device May Not Run Windows

against systems across at least 12 U.S. states are a reminder that compromise is not just another IT incident. When attackers can reach pumps, valves, pressure controls, or remote monitoring systems, the consequences can extend far beyond losing connectivity to a server.

The interesting number is not how many organizations were targeted. It is how repeatedly attackers can exploit the same architectural weaknesses across independent environments: internet exposure, remote access, weak credentials, and common third-party configurations.

OT Exposure Becomes Risk

Some have lost remote monitoring and control capabilities. In Georgia, cyber activity contributed to a pressure drop and a temporary boil water advisory.

When OT is not adequately protected, the impact can extend beyond system availability. Organizations may face disrupted operations, degraded safety controls, service interruptions, equipment impact, and consequences for the communities that depend on those systems.

The Attack Path Is Uncomfortably Familiar

have targeted internet-facing PLCs, changed passwords and IP addresses, and disrupted monitoring or control.

The lesson is not exotic . It is exposed OT, weak authentication, insufficient segmentation, and remote access that was never designed with today's threat landscape in mind.

Matters as Much as

Remove direct internet exposure, enforce secure remote access, use unique credentials and ACLs, monitor connected modems, validate PLC logic, and regularly test manual operations.

In traditional IT, a compromised server may cost you data, productivity, or connectivity. In OT, a compromised controller can affect the physical process itself.

That distinction is exactly why OT security cannot be treated as simply an extension of conventional IT security.

- https://logisek.com

Who told you it was fixed?Open your tracker and look at everything marked . Every one of those is a statement of inte...
13/08/2026

Who told you it was fixed?

Open your tracker and look at everything marked . Every one of those is a statement of intent, typed by the person who most wanted it closed.

We don't mean that cynically.

The changed the code. They believe it is fixed. They are usually right. But "believes it is fixed" and "has been shown to be fixed" are different claims, and only one of them is evidence. In most organisations the tracker records the first and reports the second.

Watch how a finding actually closes.

A is raised from the report. Someone makes a change. The ticket is closed. Something, a person or an , flips the finding to Remediated. At no point in that sequence did anyone re-run the thing that found it.

exists, of course.

It is also the first line cut when the quarter gets tight, and it is usually bought as a separate engagement with a separate budget and a separate calendar slot, which means it happens weeks or months later, in a batch, if at all. So closure is fast and cheap, and verification is slow and expensive, and the tracker treats them as the same event.

The failure modes are unglamorous and extremely common.

The went to staging and not to . The fix addressed the specific parameter in the report rather than the class of issue. The fix was correct and was reverted three sprints later by a merge nobody connected to security. The finding was closed because the system was decommissioned, except it wasn't, it was moved.

None of these are exotic. We see them constantly. All of them produce a green tracker and a live vulnerability.

Two questions, then, and we'd genuinely like to hear the answers:

- Of the findings you closed in the last twelve months, what proportion were independently re-tested rather than marked closed?
- And of those that were re-tested, how many failed?

The second number is the one that matters, because if you have never measured it, you have been reporting your remediation rate as though it were zero.

- https://logisek.com

There are kinds of system with a security record.- The first was tested thoroughly and nothing serious was found. - ...
06/08/2026

There are kinds of system with a security record.

- The first was tested thoroughly and nothing serious was found.
- The second has never been looked at, ever.
- The third was tested by someone sure they knew how, who didn't, and who wrote the silence up as a result.

In every tracker, all three produce the same row. Nothing. Green.

This is the deepest flaw in by findings alone, and it is structural. A findings register can only describe findings that exist. It has no way to represent an absence of testing, because an absence generates no rows.

So in the register is indistinguishable from safety, and the estate quietly divides into the part you are measuring and the part you have stopped seeing.

The part you have stopped seeing is usually where the comes from. Not because it is more vulnerable, but because nobody has ever pointed anything at it.

- A never-assessed system is an honest unknown: it surfaces the moment anyone looks for gaps.
- A badly assessed one does not. It has a date, a scope, a report and a sign-off. It has been counted. It closes the question it should have opened.
- An unknown you know about is a work item.
- An unknown recorded as answered is a liability.

is the number that fixes this, and it is more demanding than it sounds. It is not "how many tests did we run last year". That counts your own activity, not your exposure. And a test counts as one however little of the system it touched.

- What proportion of the estate was actually assessed, weighted by how much those systems matter?
- Within the systems in scope, how much effort was genuinely spent on each, against what was planned?

Express coverage per system, measured from what was spent rather than scoped.
- A system with no findings and full coverage is genuinely good news.
- A system with no findings and no coverage is an unknown, and should be reported as one.
- A system with no findings and a few mandays behind it is not a result, it is a question.

So the question we'd put to any :

* Can you name, right now, the systems nobody has assessed?
* Can you tell those from the ones assessed in name only? Not "probably". Name them.

If that list doesn't exist, it isn't empty. It's just unwritten.

- https://logisek.com

Five vendors, five formats, zero arithmeticCount what a mid-sized organisation buys in a single year.A web application p...
03/08/2026

Five vendors, five formats, zero arithmetic

Count what a mid-sized organisation buys in a single year.

A web application pe*******on test.
An external infrastructure test.
A red team exercise.
A source code review.
A security configuration audit.
Two retests.
Plus whatever the internal team finds, plus scanner output nobody has triaged since last year.

Six or seven separate bodies of evidence.

Each one is genuinely good work. Each one arrives in a different format, on a different schedule, from a different sender, and comes to rest in a different place: a mailbox, a shared drive, a ticket queue, someone's laptop.

Now try to add them up.

The severity scales don't match. One vendor's High is another's Medium, and the red team report doesn't use severities at all because it's written as a narrative. The asset names don't match either. The code review talks about repositories, the infrastructure test talks about IP ranges, and the application test talks about a product name that only the business uses.

So nobody adds them up.

Instead the year's security position gets assembled by hand, once, in a slide deck, in the week before the board meeting, from whichever reports the person building the deck could find.

Here is what that costs you.

Every one of those engagements is useful on its own. Together they are the only thing that could produce an honest picture of the whole estate, which is precisely the thing they never produce. You bought the raw material for an answer six times over and then threw away the ability to combine it.

The awkward part, and we say this as people who write these reports for a living, is that this is not a testing problem.

The testing was fine.

It is an evidence problem, it sits entirely on the client side of the engagement, and that is exactly why no vendor has ever fixed it for you.

A question worth asking your team this week: if we asked you for total open critical findings across the whole estate, from every source, how long would it take to produce that number, and would you stand behind it?

- https://logisek.com

The most expensive in your organisationYou paid for a . Serious money, serious people, three weeks of skilled work. T...
03/08/2026

The most expensive in your organisation

You paid for a . Serious money, serious people, three weeks of skilled work. Those findings now live in a spreadsheet that four people can edit and nobody fully trusts.

The lifecycle is always the same. The report arrives as a PDF. Someone spends a morning copying findings into Excel. A column gets added for the owner. Another for the due date. Another for status.

Then the second report arrives, from a different vendor, with different severity labels and different asset names, and someone has to decide whether "web-prod-01" and "Customer Portal" are the same thing.

This is not a discipline problem. We have watched genuinely excellent security teams end up here. It happens to people who are good at their jobs.

It is a structural problem. A spreadsheet is a flat list of rows. Almost every question a is actually asked is relational:

- Which of these findings sit on systems that actually matter to the business?
- Which ones came back after we said we fixed them?
- What have we not looked at at all?

You cannot answer any of those from rows. You can only answer them from a model of the estate underneath the findings, the assessments that produced them, and the people accountable for them.

Which is why the spreadsheet always dies. It was never a tracking system. It was a receipt.

What is your findings tracker actually called?

- https://logisek.com

The Attack That AI Cannot Reinvent do not choose the most impressive attack. They choose the cheapest attack that works...
23/07/2026

The Attack That AI Cannot Reinvent

do not choose the most impressive attack. They choose the cheapest attack that works.

can discover vulnerabilities, automate reconnaissance, and launch attacks at unprecedented speed. Yet many corporate environments can still be compromised using a technique that predates modern cybersecurity: guessing a weak VPN password.

---

The Old Entry Point Still Works

services remain exposed to support remote employees, vendors, administrators, and third-party support teams. These gateways often provide direct access to infrastructure that supports critical operations and millions of euros in business activity.

An attacker may not need an advanced exploit or an AI-generated attack chain. One reused, predictable, or weak password can be enough.

---

Makes Simple Attacks Stronger

stuffing, password spraying, and targeted brute-force attempts can now be combined with automated OSINT and adaptive authentication testing.

---

Perform regular external pe*******on tests, dedicated VPN assessments, and assumed-breach exercises. Validate MFA enforcement, account lockout controls, conditional access policies, vendor access, segmentation, and post-authentication exposure.

Do not let an attacker with almost zero budget compromise infrastructure worth millions.

- https://logisek.com

The Password Was Reset. The Device Wasn't.We have seen teams chase failed sign-ins, force a password reset, and move on....
15/07/2026

The Password Was Reset. The Device Wasn't.

We have seen teams chase failed sign-ins, force a password reset, and move on. The better question is: what did the attacker leave behind?

Sometimes, it is a device that quietly registered itself to your tenant.

---

A Device Is a Credential

In , a registered or joined device is not just hardware, it is a standing identity. Once an attacker registers their own device, it can hold a Primary Refresh Token for roughly 90 days. Resetting the password or revoking a session does not remove it.

---

MFA Blocked the Login. The Device Didn't Ask.

That is the important distinction. A device that is already registered can satisfy device-based and keep working while everyone is watching sign-in logs. These objects deserve regular attention, especially when they are unmanaged, personally owned, registered by someone other than the owner, or joined but absent from .

---

Compliant Is Not the Same as Trusted

A device can report "compliant" without ever being verified by your MDM. Faked or self-asserted compliance is a known path around device-based Conditional Access, which is why the real check is cross-referencing every device against Intune ground truth, not trusting the flag on the object.

And then there is the quiet : decommissioned machines whose Entra device object was never deleted. Reformatting the laptop does not remove the identity. Those leftover, unmanaged device objects are dormant attack surface hiding in plain sight.

---

Turning Inventory Into Early Warnings

To support this review, we are sharing Get-EntraRegisteredDevices, a PowerShell script that lists every registered and joined Microsoft Entra ID device across all users, cross-references Intune, and flags likely-rogue devices in a clear THREAT / hygiene split, with optional Excel export.

Project: https://github.com/Logisek/CloudKit
Script: Get-EntraRegisteredDevices

Conditional Access is a strong defense. Device auditing shows you which devices it is quietly trusting.

- https://logisek.com

Pen Tests Create ProblemsA growing company chose lower-spec servers to keep the infrastructure budget under control....
12/07/2026

Pen Tests Create Problems

A growing company chose lower-spec servers to keep the infrastructure budget under control. At first, the decision seemed sensible. The systems handled the initial workload, costs stayed low, and the project launched on schedule.

A few months later, customer demand increased. Applications slowed down, response times deteriorated, and outages became more frequent. The IT team eventually discovered that the infrastructure had been sized for today's traffic, not tomorrow's growth. The money saved during procurement was quickly consumed by emergency upgrades, rushed migrations, and lost customer trust.

---

Cheap pe*******on tests create the same .

A Is Not an .

A vendor runs automated tools, adds a logo, and delivers a report. It may satisfy a compliance checkbox, but it rarely reveals weaknesses in authentication, authorization, business logic, or system design.

tools cannot understand how chain minor issues, abuse legitimate workflows, or exploit assumptions unique to your application.

---

Each release, integration, cloud service, and customer increases pressure on your security foundation.

Human provides the missing reinforcement. Without it, the cost eventually surfaces through remediation work, production , , or rejected customer assessments.

A cheap pe*******on test reduces today's invoice. It does not reduce risk. It delays the bill until the structure is under pressure.

- https://logisek.com

Defines No organization is secure because nothing ever happens. Real security shows itself when pressure hits, decisi...
08/07/2026

Defines

No organization is secure because nothing ever happens. Real security shows itself when pressure hits, decisions matter, and teams must respond before impact becomes damage. Security metrics often count what is easy to measure: alerts, vulnerabilities, patches, and incidents. The harder and more valuable metric is whether the organization can withstand a realistic attack.

---

The of "No Incidents"

One of the most persistent myths in cybersecurity is that success means the absence of incidents. That mindset creates blind spots. It encourages comfort, delays hard conversations, and often rewards silence over readiness. In practice, it can leave organizations measuring luck instead of resilience.

---

The better is "How secure are we?"

That answer cannot come from dashboards alone. It comes from offensive security simulation: red team exercises, adversary emulation, pe*******on testing, and controlled attack scenarios that expose weaknesses across technology, processes, and people.

---

⚔️ Before an Forces You To

Effective cybersecurity leadership is measured by response, recovery, and adaptation. Simulations help organizations find the gaps before attackers do, validate controls before crisis, and turn lessons into measurable resilience.

Security is not the absence of failure. It is the ability to absorb, respond, and improve.

- https://logisek.com

The First Signal Is IdentityWe have seen environments celebrate blocks and move on. The better question is: why did th...
08/07/2026

The First Signal Is Identity

We have seen environments celebrate blocks and move on. The better question is: why did the attacker know the password in the first place?

Sometimes, it is just a sign-in attempt that almost succeeded.

---

When "Blocked" Still Matters

In , interactive sign-ins marked as "Interrupted" or "Failure" deserve regular attention. A result like "MFA required" may mean the username and password were correct, but the attacker could not complete the second factor.

---

MFA Stopped Access, Not the

That is an important distinction. MFA may have blocked the login, but the password may already be compromised. These events become even more valuable when they involve unusual countries, unfamiliar IPs, unknown devices, suspicious browsers, or behavior outside the user’s normal pattern.

---

Turning Logs Into Early Warnings

To support this review, we are sharing Get-EntraInteractiveSignInIssues, a PowerShell script that lists failed and interrupted Microsoft Entra ID interactive sign-ins over the last 1-30 days, with optional Excel export.

Project: https://github.com/Logisek/CloudKit
Script: Get-EntraInteractiveSignInIssues

MFA is a strong defense. Sign-in auditing helps you understand what MFA may have stopped.

- https://logisek.com

Address

Koropí

Opening Hours

Monday 09:00 - 18:00
Tuesday 09:00 - 18:00
Wednesday 09:00 - 18:00
Thursday 09:00 - 18:00
Friday 09:00 - 18:00

Telephone

+302106626841

Website

Alerts

Be the first to know and let us send you an email when Logisek posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The Business

Send a message to Logisek:

Shortcuts

Share

Category