Authorized security assessments · Zürich

Swiss-sovereign
AI security assessments.

Frontier open-weight security models, run on Swiss GPUs or inside your own network. Your code, logs and findings never leave Switzerland.

Book a scoping call How it works
Processing
Switzerland only
Third-party APIs
None
Findings
Human-validated
Pricing
Fixed after scoping

Process

Four steps. No surprises.

Every engagement follows the same controlled sequence. Nothing is tested before it is authorized in writing, and nothing changes state without a human saying yes.

  1. 01

    Scope and written authorization

    We agree targets, time windows and rules of engagement in a short call. You sign a written authorization before any test traffic is sent.

  2. 02

    Isolated deployment

    Models run in a Swiss datacenter or on an appliance inside your network. No outbound network access beyond the agreed targets.

  3. 03

    Agentic assessment

    AI agents test within a technically enforced scope allowlist. Any state-changing action is paused until a human approves it.

  4. 04

    Human-validated report

    Every finding is reproduced and signed off by a human, with evidence, severity and remediation. One retest of fixed findings is included.

Difference

Built for organizations whose data cannot leave the country.

  • Swiss-only processing

    Inference runs on GPUs located in Switzerland or on your own hardware. No US or Chinese model APIs are involved at any point.

  • Data processing agreement

    A DPA aligned with the Swiss FADP (nDSG) and the EU GDPR is part of every engagement, with retention and deletion terms agreed up front.

  • On-prem option

    For regulated environments, the full stack runs as an appliance inside your perimeter, without internet access.

  • Human sign-off

    Automation finds candidates; people confirm them. No finding reaches your report without manual verification.

  • Fixed prices

    You receive a fixed quote after the scoping call. No open-ended day rates.

  • Days, not weeks

    Agentic testing shortens the active test phase. The delivery date is fixed in writing at scoping.

Services

Assessments

Each service ends in the same deliverable: a human-validated report with evidence, risk rating and remediation guidance.

  • Web app and API assessment

    Authentication, authorization, injection, business logic and API abuse, guided by OWASP ASVS and the OWASP API Security Top 10.

    Web / API

  • External perimeter

    Internet-facing hosts and services, exposed admin interfaces, TLS and DNS configuration, and forgotten assets.

    Perimeter

  • Internal network and Active Directory

    Assumed-breach testing from inside: segmentation, privilege escalation paths, Kerberos and AD misconfigurations.

    Internal / AD

  • Cloud configuration review

    IAM, network exposure, storage, logging and key management on AWS, Azure, GCP and Swiss providers, with read-only access.

    Cloud

  • Continuous assessment

    Recurring, scoped testing of your external surface and key applications. New findings are validated and reported monthly.

    Subscription

  • On-prem appliance

    The assessment stack on dedicated hardware inside your network, for environments where nothing may leave the premises.

    Appliance

Pricing

Indicative pricing

Indicative starting prices in CHF, excluding VAT. After the scoping call you receive a fixed price for your exact scope.

One-off assessments include a human-validated report and one retest of fixed findings. Internal network and Active Directory assessments are quoted individually after scoping.
Web app and API assessmentfromCHF 3,500
External perimeterfromCHF 4,500
Cloud configuration reviewfromCHF 4,000
Continuous assessmentfromCHF 1,500/ month
On-prem applianceOn request

Fit

Who it is for

Swiss SMEs and SaaS or fintech suppliers who need credible, independent evidence of their security posture.

  • ISG reporting duty

    Operators of critical infrastructure must report cyberattacks to the Federal Office for Cybersecurity (BACS) under the Information Security Act. Knowing your exposure beforehand matters.

  • FINMA Circular 2023/1

    Banks must manage ICT and cyber risks, including regular vulnerability assessments and penetration tests, and pass these expectations on to critical suppliers.

  • NIS2 supply-chain questionnaires

    EU customers in scope of NIS2 pass security requirements down to their suppliers, including Swiss ones.

  • Customer security reviews

    Enterprise procurement asks for a recent third-party penetration test. A current, validated report answers that question directly.

An assessment supports these obligations. It does not by itself establish compliance.

Trust and legal

Rules we work by

Responsible disclosure

Found a vulnerability in our own systems? Please report it. We respond to every good-faith report.

security@icewall.ch

  • Written authorization

    Every engagement runs under a signed authorization and agreed rules of engagement.

  • Agreed scope only

    We test only the systems, accounts and time windows you approved. Scope is enforced technically, not just contractually.

  • Data deletion

    Engagement data, including logs and evidence, is deleted at the end of the agreed retention period.

  • Approval before impact

    No exploitation, write or configuration change happens without explicit approval by a human tester.

Start with a scoping call.

We clarify scope, constraints and timing, then send you a fixed quote.

Book a scoping call