It is the program that allows companies to raise awareness of information security and to adopt this awareness from the top managers to employees in the lowest staff. In this program, the attack attacks are simulated during the year, the reaction of the employees against attacks is recorded and trainings are given to employees for information security. Within the scope of the program, the progress of employees in the field of information security awareness is also followed through the interface. In this way, cyber risks due to human errors are reduced.

• Simulations and Trainings: Scenarios such as phishing attacks are simulated throughout the year and employees are trained on how to react to these attacks.
• Participatory Structure: The program covers all employees, from the top managers to the lowest staff. Thus, information security awareness is disseminated throughout the organization.
• Performance Monitoring: Employees' information security awareness and progress are regularly monitored. In this way, weak points are identified and necessary measures can be taken.
• Customization and Adaptability: The program can be customized and tailored to the needs and priorities of the organization. Thus, the most effective results are obtained.
• Reducing Human Errors: The goal of the program is to reduce cyber risks caused by human errors by increasing employees' awareness of information security.

CIS (Center for Internet Security Inc) is an institution that works with the common mind of the global information community by performing private and public institutions in the face of cyber security threats. There are 171 security controls listed under 20 main items that CIS recommends the application of Sans Institute within the scope of cyber security checks. A detailed report is created by providing these controls with expert consultancy of KoçSistem, which is authorized by CIS.

• Comprehensive Assessment: Provides a comprehensive assessment for topics such as system and device inventory, software and application inventory, access controls management.
• Technical and Executive Reporting: It provides different levels of information to customers by providing executive summary reports along with detailed reports containing technical analysis results.
• Development Suggestions: It offers development suggestions based on the competence, applicability and automation perspectives that emerged as a result of the evaluation.
• Preparation and Evaluation Stages: The evaluation service starts with the preparation phase and follows the steps that include technical analysis and reporting processes.
• Workshops and Information Collection: Through workshops and meetings held with the participation of KoçSistem and customers, it supports the process of collecting and evaluating information in line with the needs of the customer

After many factors, such as the spread of cloud -based software, the transition to SAAS applications and the rapid increase in IoT practices and the rapid increase in assets, businesses change the ways of approaching risk management and the security of digital assets. All these new technologies increase the attack surface and make it difficult for security teams to detect these inventories and thus protect them.

With the security attack surface monitoring and analysis service, all digital assets that are open to foreign companies are scanned regularly. Thus, the shadow It) is detected and unknown to the security units and controlled against the known weaknesses and security risk rating over an interface and Detailed reporting is made.

• Comprehensive Scanning: Scans the organization's attack surface on the Internet and detects potential weak points and vulnerabilities.
• Active and Passive Scanning: It provides a comprehensive security analysis by using both active (interfering with network traffic) and passive (observation-based) scanning methods.
• Detailed Reporting: It provides comprehensive information about the security status of the organization by reporting the detected vulnerabilities and risks in detail.
• Continuous Monitoring and Update: The organization's attack surface is constantly monitored and updated so that new vulnerabilities are notified as they emerge.
• Customizable Analysis: It offers customizable analysis options based on the needs of the organization and allows for a more in-depth dive by focusing on specific areas.

The aim of the red team service is to simulate the real attacks focused on critical powers, raising critical information from the institution, providing access to critical areas, and seizing critical powers rather than weakness. Unlike the infiltration test service, a limited number of people are informed of the institution in Red Team studies so that the actions of the information security teams and corporate systems can be measured and observed in the face of simulated attacks. At the end of the service, all action steps are reported on a day and time basis, the effects of the actions are presented with evidence, causes and images.

• Penetration Tests and Simulations: Performs penetration tests and attack simulations to test the organization's defense mechanisms.
• Real-World Scenarios: By mimicking real-world attack scenarios, it ensures that the organization is prepared for real-life threats.
• Weak Point Detection: It identifies the weak points in the organization's defense systems and makes suggestions to strengthen these points.
• Assessment of Response and Response Capabilities: Evaluates the organization's response and response capabilities to cyberattacks and identifies areas for improvement.
• Reporting and Recommendations: By reporting the results of the tests in detail, it provides defense strategies and recommendations to the organization against attack.