Skip to main content

Digital resilience

Cyber and data resilience

We'll map your management's digital footprint and approaches — corporate and private — and prepare an incident response plan. We are here for prevention and for the moment when something is already happening.

Arrange a discreet consultation What you get
The specialist compares the printed access list with the management's laptop in a neutral meeting.
digital footprint mapincident response (IR) planpriorities for management

He is responsible for this service

Adam Schinzel

Division Director GBH Cyber

The assistant at the desk takes her hand off the keyboard of the unresponsive laptop and reaches for the phone.

First reality, then measures

Cyber incident with rarely reported as a technical fault. A fraudulent payment instruction arrives from a hijacked e-mail box (BEC), a fake director's voice in an accountant's headset (deepfake), or encrypted data and a threat to publish it. At the same time, an attacker rarely breaks into company systems — he enters through a leaked password, private e-mail or home network. The most exposed are management, assistants and people with access to money and contracts. Without a prepared procedure, chance and pressure decide.

  • Most incidents start with a leaked password, a hijacked account, or a forgotten permission — not an unknown software bug.
  • The management attack surface also includes private accounts, home network and family — the attacker does not distinguish between them.
  • In a crisis, it's not just about IT — decision-making, payments and communication stop.
  • An attacker often only needs one leaked login and a missing second login factor.

Scope

What the product is — and what it isn't.

Includes

  • Identity and authorization verification — included third-party vendors and applications.
  • Inspection of management equipment, by agreement also of private accounts and household.
  • Assessment digital tracks: leaked data, old profiles, fake domains.
  • Incident response plan, hardening priorities and staff exercises with leadership.

Does not include

  • We do not attack third party systems or track third parties.
  • We do not replace your IT department or network administrator.
  • We do not promise 100% safety — we will also describe the residual risk.
  • Without yours written authorization we do not interfere with any system.
At the table, the counselor and client go through the one-page scope of the background check and mark the boundary with a pencil.
Two specialists at the table map accounts, devices and permissions — the status discovery phase.
The client's IT team turns on the second factor and corrects the device settings — the hardening phase.
A specialist at a desk reviews operational records on a remote monitor — the monitoring phase.
The team and management at the table review the printed incident response plan — the response phase.

Procedure

First the reality. Then measures.

  1. 01

    Status detection

    Status detection (digital footprint)

    We map accounts, devices and permissions — a what is traceable about leadership: leaked data, old profiles, records with data traders.

  2. 02

    Strengthening priorities

    Fixing priorities in settings

    We turn on the second factor, remove the old rights and permissions of third-party applications — the first thing that stops traffic.

  3. 03

    Monitoring systems

    Monitoring systems and leaks

    We will set up with your IT what to look out for: suspicious logins, forwarding rules, leaked data and spoofed domains (typosquatting).

  4. 04

    Incident response

    Incident Response (IR — Response Plan)

    We'll write out the procedure: isolation, evidence, notification to authorities, communication outside — and rehearse it with management.

Coverage

Corporate and private management layers — just your systems, with your credentials.

The hands of the specialist compare the printed access matrix with the laptop and mark the old permissions.

Identities and approaches

Management, authorization and sharing accounts — including vendor access and third-party application authorization (OAuth).

A technician checks the encryption and backup settings on the company phone and laptop.

Equipment and household

Laptops, phones and tablets — business and personal: encryption, backups, remote deletion, home network by agreement.

A specialist at the monitor reviews email forwarding rules and suspicious logins.

Cloud and email

Forwarding rules, suspicious logins, application permissions and shared mailboxes — the most common path to BEC.

The person at the desk verifies the authenticity of the payment instruction by phone according to the paper contact.

Communication

Channels for sensitive transactions and authentication of payment instructions — defense against BEC and deepfake calls.

The management at the table goes through the incident card with the procedure, who decides and what is disconnected.

Incident response

Isolation of the incident, securing of evidence, notification obligations, external communication.

A specialist with guidance marks on the operational map the systems and suppliers whose outages stop decision-making.

Traffic dependencies

Vendors with access to systems, shared admin accounts, critical services.

Executives at the table review a printed digital resilience plan and point to a list of priorities.

Output for management

Digital Resilience and Response Plan

Structured document for management (PDF) + one-page summary of priorities.

What the document contains

  1. Risk-prioritized identity, device and digital footprint map.
  2. Incident Response (IR) Plan: containment, securing evidence, notification obligations, communication.
  3. List of Priority Hardening Settings — what to do first.
  4. Lines of communication for an incident: management, IT, legal representative, insurer.
  5. Management recommendations in plain language, without technical jargon.

The document describes your condition and your decision making, not specific threats. We hand it over securely and only to agreed people.

Role and mode

Who decides and how we cooperate.

  1. 01

    Head of background checks

    One contact for the entire collaboration; controls the scope, deadlines and deliverables.

  2. 02

    Technical specialist

    Scans identities, devices and the cloud; conducts containment and securing of evidence at an incident.

  3. 03

    Management consultant

    Translates technical findings into decisions and priorities for management.

The review manager hands over the output folder to the management and summarizes the next steps and deadlines.

Operational log

  • An initial review has a clear beginning and end, usually in a matter of weeks.
  • We review the output with management and IT in one joint meeting.
  • During ongoing cooperation, we review approaches and the digital footprint typically quarterly.
  • An acute incident has its own entry: pre-given contact and immediate escalation.
One time or continuously
One-time verification, ongoing supervision of access and footprint, or a contingency contract in case of an incident.
Working with your IT
We do not replace the network administrator, we supplement it. We work alongside internal IT or a supplier.
Scope by scenarios
We build the scope on your real-world scenarios — fraudulent instruction, blackmail, data breach — not on a catalog of checks.
Dates
Initial vetting usually within weeks; We deal with suspicions of compromise immediately.

Discretion

There is no one to learn about cooperation with us. We work in mode need-to-know — sensitive information is known only to those who absolutely need it for work. We store the outputs securely and hand them over only to agreed people. We do not use your name as a reference. We proceed inconspicuously, so that the normal traffic and the surroundings do not recognize anything.

  • Nondisclosure Agreement (NDA) for the entire team.
  • Secure storage and transfer of outputs.
  • Screened and contracted specialists.
  • Low profile — inconspicuous procedure with no traces in operation.

Standards and the law

Trusted capacity, within the limits of the law.

  • Verified specialists with experience in defense and corporate security.
  • We are based on recognized risk management frameworks (ISO 27001, NIST) — without certification.
  • We only work on your systems and only with your written authorization.
  • Documentable competence in the technique and tools used.
  • We support findings with evidence, not impressions.
We work within the limits of the law and within the framework of the relevant authorizations. We only scan your own systems, accounts and devices, and only with your written consent. We do not hack into other people's systems, we do not monitor third parties and we do not obtain data from non-public registers. We process everything in accordance with GDPR. We do not do what is outside the law.
The specialist ticks off the checklist items according to a recognized risk management framework.

Proof system

Specifically, but discreetly.

A service detail should not end with a promise. It shows an anonymized scenario, methodology and output that management will really use.

We do not show the client. We show the decision.

  • 01 A find. Which is really weak.
  • 02 Procedure. Who decides and when.
  • 03 Output. Digital Resilience and Response Plan

Deliverable preview

Digital Resilience and Response Plan

  • Risk-prioritized identity, device and digital footprint map.
  • Incident Response (IR) Plan: containment, securing evidence, notification obligations, communication.
  • List of Priority Hardening Settings — what to do first.

Guides and analysis

Threema for business: what protects E2EE and where it has limits

A practical guide to the choice and seven-micron deployment of Threema Work according to current sources NÚKIB and the manufacturer.

Industrial espionage: legal framework and safe practice

How to distinguish between legal and illegal information acquisition, preserve evidence, and manage a breach response.

Part of the GBH group

GBH Partners

Coordinating movements and traffic if the incident affects supplies.

GBH Capital

Investment division of the security infrastructure financing group.

GBH Cyber

The group's technical division — penetration tests, audits and secure development.

GBH Bunker

Protected data infrastructure in terms of business continuity.

GBH Academy

Management and team training in safe handling of data and AI.

Related services

All services
The consultant and the company team at the table go through the documentation and decide which information is sensitive.

Information protection

Protection against industrial and commercial espionage

classification of information
closed escape routes
situational OPSEC rules
A plainclothes technician checks a conference table with a handheld detector in a neutral meeting room before a meeting

Protection against eavesdropping

Protection against eavesdropping (TSCM)

defense technical inspection
finding report with spectrum recording
mode of action
The management of the company goes through the printed crisis playbook with a facilitator at the table.

Leadership readiness

Preparing for a crisis

readiness assessment
crisis playbook
staff exercise (TTX)
At the table, the consultant and the client calmly solve questions about the scope of the digital background check and the legal boundaries.

Questions for decision

Do you hack into systems to find weak points?

Nope. We only work on your systems and only with your written authorization. We look for weak points in a defensive way — by checking settings, permissions and accesses. Attacking foreign systems is a crime and we don't do it.

Will the background check disrupt our normal operations?

We will do most of the work discreetly alongside your IT. If something requires an intervention in the settings, we will arrange it in advance and time it in such a way that there is as little traffic disruption as possible.

Are you replacing our IT department or a supplier?

No, we are adding them. We do an independent review and response plan; we leave regular operation, network management and maintenance to your IT or the supplier we work with.

What happens if something is found during the background check?

We will describe the findings in a comprehensible way and propose a sequence of steps. If we suspect a compromise, we first check whether the attacker is no longer inside (compromise assessment) — only then do we strengthen. In case of a serious finding, we will arrange for immediate isolation and securing of evidence.

Will anyone find out that we are working with you?

Nope. We work in need-to-know mode (information is known only to those who absolutely need it), we store outputs securely and do not use your name as a reference. We have a confidentiality agreement.

Will you guarantee that no one will attack us again?

Nope. No one honestly promises 100% security. However, we can significantly reduce the most serious risks, prepare you for an incident and tell you what you don't need to deal with. We always name the residual risk.

Tomáš Šlesinger

Let's start with a casual conversation

"Tell us what drives you to ask about digital resilience. We'll find out first, then propose action — and only what makes sense."

Tomáš Šlesinger · GBH Group Security Advisor

Contact us

The first step doesn't have to be big. It must be correct.

We arrange a discreet orientation call, name the type of risk and recommend the next safe step.

15 minutes

by phone

CZK 0

orientation

24 h

reaction

Call Write
GBH Defence office in Prague

First contact protocol

First we understand the situation. Then we suggest the next step.

Briefly write what you are dealing with. We will contact you discreetly and arrange a safe call format.

Call safely

Leave your contact information and we'll get back to you