Services · Cybersecurity
Cybersecurity for HR + people data
Employee files, salary data, and candidate DBs are top-tier ransomware targets. We deliver the network segmentation, GDPR-grade access controls, and the EU Whistleblower Directive (Mt. 32/A) reporting flow that protects bot the data and the reporter.
- HR cybersecurity
- GDPR HR
- whistleblower Hungary
- HR kiberbiztonság
- bejelentő Magyarország
Where it lands in this industry
- Employee-data access controls (GDPR)
- Whistleblower reporting flow (Mt. 32/A)
- HRIS hardening + supplier-risk review
- Phishing simulation tuned to HR (CV malware)
- Background-check vendor security audit
What you get
Web applications, APIs and, increasingly, AI agents. Prompt injection is not a theoretical problem once your bot can read a customer's message and call a tool. We test what an attacker would actually try, write it up with reproduction steps, then fix it and re-test. You get the exploit, not a scanner report with 400 informational findings.
- A findings report with reproduction steps, severity and business impact in plain words
- The fixes, applied and re-tested, not just recommended
- Hardening of the boring surfaces: auth, session handling, uploads, admin routes
- An AI-specific pass if you run agents: tool scoping, output filtering, injection tests
Work from this bench
DIMOP Plusz · GINOP Plusz · Vállalkozz Digitálisan
Buying this with a digitalisation grant
DField Kft. is an accredited IT supplier in the Hungarian Chamber of Commerce and Industry's Modern Vállalkozások Programja (Vállalkozz Digitálisan). Hungarian SMEs can order this work through the programme's grant calls, currently DIMOP Plusz 1.2.6 and earlier GINOP Plusz, with the formal quote issued on the programme portal.
How a grant-funded order worksStraight answers
- Will the test break production?
- We agree the blast radius in writing first and prefer a staging copy. Where production testing is necessary it is scheduled, rate-limited and supervised.
- We already ran a scanner. Is that enough?
- A scanner finds known patterns. It does not chain three medium findings into an account takeover, which is what an attacker does and what we do.
- Can you test an AI agent?
- Yes. That is a distinct pass: what the agent can be talked into calling, what it will repeat back, and what happens when a customer pastes an instruction into a support ticket.
- Can we pay for this with a digitalisation grant?
- Yes. DField Kft. is an accredited IT supplier in MKIK's Vállalkozz Digitálisan programme, so a Hungarian SME can buy custom software, integrations, AI automation and security work through the DIMOP Plusz calls, as it could under GINOP Plusz. The formal quote is issued on the programme portal; the scope, fixed price and hand-over are the same as for any other project.
- How long does an engagement take?
- A focused test on one application is usually days rather than weeks; a broader scope with AI agents and infrastructure takes longer. The scope conversation is what determines it, and we would rather narrow the scope than stretch the honesty of the coverage.
- What do we get at the end?
- A report where each finding has reproduction steps, an honest severity and what it means in business terms — plus the fixes applied and re-tested. Informational noise is left out rather than padded in to make the document look thorough.
- Do you need production access?
- Preferably not. A staging copy that matches production is the safer arrangement, and where production testing is genuinely necessary it is scheduled, rate-limited, supervised and agreed in writing beforehand.
By industry
Tell us the problem in plain words.Book the intro call
