Question 1

What does BSD Management do?

Accepted Answer

BSD Management is a cybersecurity consulting firm based in Chișinău, Moldova. We specialise in penetration testing, IT audit, information security management, and security training to help organisations reduce risk and ensure compliance.

Question 2

Where are you located?

Accepted Answer

We are based in Chișinău, Moldova, but we work extensively across Moldova, Romania, Ukraine, Lithuania, Hungary, and other EU and CIS regions.

Question 3

What industries do you serve?

Accepted Answer

Our primary focus is financial services, banking, and fintech, but we also work with energy, retail, agricultural, and public sector organisations. Our clients include the World Bank, UNDP, OTP Bank, and Paynet.

Question 4

How do I get started?

Accepted Answer

Schedule a free diagnostic call through our contact page. We learn about your organisation's context and needs, then define the right services and provide a transparent proposal. Once accepted, we deliver the engagement, report the results, and support remediation, with the option of an ongoing partnership. We typically respond within 24 hours.

Question 5

What is penetration testing?

Accepted Answer

Penetration testing is an authorised, simulated cyberattack on your systems. We manually attempt to exploit vulnerabilities to validate their real business impact, going far beyond automated scanning.

Question 6

What types of penetration testing do you offer?

Accepted Answer

We cover Network & Infrastructure, Web Applications & APIs, Mobile Apps (Android/iOS), Cloud environments, as well as Social Engineering and Phishing campaigns.

Question 7

How long does a penetration test take?

Accepted Answer

A focused web application test typically takes 5–10 business days. A comprehensive infrastructure engagement may take 2–4 weeks, depending on the scope.

Question 8

What do I receive at the end?

Accepted Answer

You will receive an executive summary for management and a detailed technical report for your IT team. The report includes CVSS scores, exploit evidence, and clear remediation steps. We provide remediation support and a free retest of critical findings, with the option to continue through a long-term partnership.

Question 9

Do you test regulated environments?

Accepted Answer

Yes. Financial services is our primary sector. We conduct assessments tailored to NIS2, PCI-DSS, and the specific requirements of the National Bank of Moldova.

Question 10

What's included in an IT audit?

Accepted Answer

Depending on the agreed scope, the audit may include regulatory compliance assessment; information security, information systems, server, network and data centre infrastructure audits; operating platform and database audits; IT General Controls (ITGC); and Business Continuity and Disaster Recovery (BCP/DRP) evaluation.

Question 11

How is an IT audit different from a penetration test?

Accepted Answer

A penetration test actively attempts to exploit vulnerabilities to demonstrate technical and business impact. An IT and security audit assesses technology, data, applications, processes, and people as one connected environment, including whether controls are appropriately designed and operating against applicable requirements and frameworks. The two services address different objectives and can complement each other.

Question 12

Which frameworks do you audit against?

Accepted Answer

Depending on the audit objectives, we apply National Bank of Moldova requirements, ISO 22301, ISO 27001, NIST CSF 2.0, COBIT, ITIL, EBA ICT Risk Guidelines, NIS2, GDPR, and PCI DSS.

Question 13

What types of training do you offer?

Accepted Answer

We offer executive workshops, information security training, workshops for ICT auditors, and security awareness programmes for non-technical staff.

Question 14

Which delivery formats and languages are available?

Accepted Answer

Programmes can be delivered through in-person workshops, live online sessions, blended learning, or on-site team training. Training is available in English, Romanian, and Russian.

Question 15

Can training programmes be tailored to our organisation?

Accepted Answer

Yes. We tailor content to the audience, roles, organisational risks, and programme objectives, including for boards, senior management, ICT auditors, and non-technical staff.

Question 16

What is RedRisk.eu Platform?

Accepted Answer

RedRisk.eu is a platform for managing the complete ICT and security risk cycle: identifying risks, monitoring indicators, planning treatment measures, and reporting the risk profile.

Question 17

Which modules and delivery options does RedRisk.eu provide?

Accepted Answer

The platform includes asset inventory, a risk register, Key Risk Indicator (KRI) monitoring, treatment plan tracking, audit findings management, and executive reporting. It can be delivered On-Premise or in the Cloud (SaaS).

Question 18

What is Outthink.io?

Accepted Answer

Outthink is an AI Human Risk Management platform, and BSD Management is a Human Risk Management partner. It helps organisations improve secure behaviour across their entire workforce.

Question 19

What capabilities does Outthink.io provide?

Accepted Answer

Outthink provides autonomous AI phishing simulations, adaptive security awareness training, real-time behavioural nudges, a Human Risk Score per employee, and Deepfake and AI threat simulations.

Question 20

How much does a penetration test cost?

Accepted Answer

After the diagnostic call, we define the services, engagement boundaries, and methodology, then provide a transparent fixed-price commercial proposal. The cost depends on the project's scope and complexity, and the initial diagnostic call is free.

Question 21

How much does an IT and security audit cost?

Accepted Answer

The cost depends on the audit scope, the number and complexity of systems assessed, applicable regulatory requirements or frameworks, and the volume of evidence to be reviewed. After the diagnostic call and scope definition, we provide a transparent fixed-price proposal.

Question 22

How much does a training programme cost?

Accepted Answer

The cost depends on the programme objectives, audience, number of participants, duration, delivery format, and level of customisation. Once these elements are agreed, we provide a fixed-price proposal for the programme.

Question 23

Do you offer retainer arrangements?

Accepted Answer

Yes. For clients requiring regular assessments, continuous advisory, or annual audit programmes, we offer retainer contracts which include priority scheduling and reduced rates.

Question 24

Is the first consultation really free?

Accepted Answer

Yes. We offer a free 30-minute diagnostic call with no obligation to proceed. It helps us understand your context, requirements, and the services best suited to your organisation.

Question 25

How do you handle confidentiality?

Accepted Answer

We sign a mutual Non-Disclosure Agreement (NDA) before any sensitive information is shared. Our team strictly adheres to the CMC and CISA codes of ethics.

Frequently Asked Questions

General Questions

Penetration Testing

IT Audit & Security

Training & Consulting

RedRisk.eu Platform

Outthink.io

Engagements & Pricing