Cybersecurity for your website, app, server and email
VirtuoLab secures websites, web apps, servers and email for small and medium-sized businesses. It starts with a security check: which software runs, what is exposed to the internet and what is out of date. Then come the measures: updates, a tight server configuration, encrypted backups, monitoring and email security with SPF, DKIM and DMARC. You get a report in plain language and a fixed price for the work.
Security check, hardening, backups, monitoring and email security
Environments
Websites, web apps, WordPress, Linux VPS and cloud
Guidelines
OWASP Top 10, CIS Benchmarks, least privilege
Report
In plain language, prioritised per risk
Contact
Directly with the developer; fixed price after a free intro call
How VirtuoLab secures a server
The measures per layer, from the traffic in front of the server to the backup behind it. Which ones are needed depends on the environment; every server VirtuoLab sets up gets the essential ones. Monitoring runs day and night; follow-up happens on working days from 09:00 to 18:00.
Measure
What it does
Priority
Cloudflare WAF and DDoS protection
Filters attacks, malicious bots and suspicious traffic before it reaches the server
Essential
Tailscale and SSH keys
Management over a private network: SSH is not publicly reachable and password login is off
Essential
Firewall (UFW or nftables)
Closes every network port except the ones needed, such as 443 for HTTPS
Essential
Automatic security updates
Installs operating system security patches as soon as they are released
Essential
Encrypted offsite backups
Protects data against a hack, ransomware or loss of the server
Essential
Docker hardening
Isolates applications, limits privileges and keeps internal services out of reach
Essential with Docker
CrowdSec
Recognises attack patterns in log files and blocks suspicious IP addresses
High
AppArmor and process isolation
Limits what a compromised process can read, write and execute
High
Lynis audit
Checks the server for weak or incorrect security settings
High
auditd and AIDE
Records important system actions and flags changed system files
High
Monitoring and alerts, day and night
Warns about suspicious activity, outages and system problems
High
Wazuh (EDR and SIEM)
Collects security events centrally and flags suspicious behaviour
Advanced
Cloudflare WAF and DDoS protectionEssential
Filters attacks, malicious bots and suspicious traffic before it reaches the server
Tailscale and SSH keysEssential
Management over a private network: SSH is not publicly reachable and password login is off
Firewall (UFW or nftables)Essential
Closes every network port except the ones needed, such as 443 for HTTPS
Automatic security updatesEssential
Installs operating system security patches as soon as they are released
Encrypted offsite backupsEssential
Protects data against a hack, ransomware or loss of the server
Docker hardeningEssential with Docker
Isolates applications, limits privileges and keeps internal services out of reach
CrowdSecHigh
Recognises attack patterns in log files and blocks suspicious IP addresses
AppArmor and process isolationHigh
Limits what a compromised process can read, write and execute
Lynis auditHigh
Checks the server for weak or incorrect security settings
auditd and AIDEHigh
Records important system actions and flags changed system files
Monitoring and alerts, day and nightHigh
Warns about suspicious activity, outages and system problems
Wazuh (EDR and SIEM)Advanced
Collects security events centrally and flags suspicious behaviour
01
What does VirtuoLab do in cybersecurity?
VirtuoLab secures the digital environment of a small or medium-sized business: the website, the web app, the server it runs on and the business email. The work has four parts. First, a security check that maps which software runs, which ports are open, which versions are outdated and who has access to what. Second, hardening: configuring the server and the application so that only what is needed is exposed, with key-based or two-factor login and permissions per user. Third, continuity: encrypted backups in another location, a tested recovery procedure and monitoring that alerts on outages or suspicious login attempts. Finally, email security with SPF, DKIM and DMARC, so nobody can send email on behalf of your domain. VirtuoLab works to the OWASP Top 10 for applications and the CIS Benchmarks for servers. You get a report in plain language, explaining for each risk what it means and what it costs to fix.
02
Why does cybersecurity matter for a small business too?
Cybersecurity matters for a small business because attackers rarely pick a target by name; they find weak spots automatically. According to the 2025 Cybersecurity Monitor of Statistics Netherlands (CBS), 40% of businesses with 2 to 10 people take at most 3 of 12 common security measures. Only 33% of those small businesses encrypt data, against 91% of businesses with 250 or more people. At the same time, only 19% of all businesses are insured against cyber incidents. Internationally, Verizon's 2025 Data Breach Investigations Report shows where things go wrong: a vulnerability was the starting point of 20% of breaches, 34% more than a year earlier, and credential abuse of 22%. In 30% of breaches a third party was involved, such as a supplier or hosting company. For a small business, an incident often means days of downtime, recovery costs and, if personal data leaked, a report to the data protection authority.
03
What does a VirtuoLab security check include?
A VirtuoLab security check is a structured review of your website, app, server and email, with a report that gives every risk a priority. The check covers five areas. First, software: which versions of the operating system, web server, PHP or Node.js, WordPress and plugins are running, and which have known vulnerabilities. Second, the outside: which ports and services are exposed to the internet, whether HTTPS and the security headers are set correctly, and whether the SSL certificate renews automatically. Third, access: who has admin rights, whether there are shared passwords or old accounts, and whether two-factor authentication is on. Fourth, backups: do they exist, are they stored in another location, and has a restore ever been tested. Finally, email: the SPF, DKIM and DMARC records of your domain. The report is in plain language, with the severity, impact and fix for each finding. You then choose what VirtuoLab fixes at a fixed price.
04
How does VirtuoLab secure a website or web app?
VirtuoLab secures a website or web app in the code and in the environment around it. In the code, access control comes first, because broken access control is number 1 in the OWASP Top 10 of 2025: OWASP found it in 100% of the applications tested. Every request therefore checks who owns the data, not just whether someone is logged in. The app also validates all input, stores passwords only as a strong hash and never keeps secrets in the code. Dependencies are kept up to date, because outdated packages are a constant source of breaches. Around the code: HTTPS only, security headers, rate limiting on logins and forms, and logging of suspicious actions. One example is FiscalDesk, VirtuoLab's own accounting software: each firm is isolated in the database with row-level security, and every uploaded file passes the ClamAV virus scanner first. For existing sites such as WordPress, the work starts with updates, fewer plugins and a web application firewall.
05
What should you do after a security incident?
After a security incident, the first step is to contain the breach, not to wipe everything at once. First, take an affected system off the network or put the site into maintenance mode, so the attacker cannot go further. Second, secure log files and a copy of the affected server, because you need them to understand what happened. Third, change all passwords and API keys and revoke active sessions. Then restore from a clean backup made before the incident, and close the hole the attacker came through before going live again. If personal data leaked, report it to the data protection authority within 72 hours, as the GDPR requires. VirtuoLab helps with each of these steps for websites, apps and servers it builds or manages. During the PHP vulnerabilities of October 2026, for example, VirtuoLab mapped within a day which sites could be affected and what needed to happen.
Our own products
Software we build and run ourselves
FiscalDesk and Bouwklok are VirtuoLab products. Both are live and can be tried. The images below are recordings and screens from the software itself.
Does the Dutch Cybersecurity Act (NIS2) apply to my business?
The Cyberbeveiligingswet is the Dutch implementation of the European NIS2 directive and has applied since 15 August 2026. It targets essential and important entities in the sectors the act lists, such as energy, transport, healthcare, digital infrastructure, waste management and parts of manufacturing. As a rule, it concerns medium-sized and large organisations: from 50 employees or more than €10 million in annual turnover. For some digital services it applies regardless of size. Most small businesses are therefore not directly covered. They do notice the law through their customers: an organisation that is covered must also assess the security of its suppliers and asks about it more often. VirtuoLab gives no legal advice on whether your organisation is covered; the government's self-assessment and a lawyer are the right route for that. VirtuoLab does help with the technical measures the law and your customers expect.
How do you stop others from sending email on behalf of your domain?
You prevent email spoofing with three DNS records: SPF, DKIM and DMARC. SPF lists which servers may send email for your domain. DKIM puts a digital signature on every message, so the recipient can check it was not altered on the way. DMARC tells receiving mail servers what to do with mail that fails those checks: nothing, quarantine or reject, and it sends reports back. Since February 2024, Google requires senders of more than 5,000 messages a day to Gmail to have SPF, DKIM and DMARC in place, and for smaller senders it also helps keep mail out of the spam folder. VirtuoLab sets up the records step by step: first DMARC in monitoring mode, to see which services send mail for your domain, such as your accounting software or newsletter tool. Only when everything checks out does the policy move to quarantine and then to reject. Legitimate mail keeps arriving, and phishing in your name gets harder.
Does VirtuoLab carry out penetration tests?
VirtuoLab carries out security checks: a review of configuration, versions, access, backups and the known vulnerabilities in the OWASP Top 10, with automated scans and manual review. For most small business websites and apps, that is the most useful first step. A formal penetration test is something else: an attack by certified testers following a fixed method, with a report that an auditor or large customer accepts. If a customer, insurer or certification asks for such a pentest, a specialised security firm is the right party, and VirtuoLab says so honestly. VirtuoLab then fixes the findings in the code and the server configuration, and can prepare the application so the test runs efficiently: a test environment, test accounts per role and documentation of the architecture. For software that VirtuoLab builds itself, the main checks are already part of the build process, such as dependency checks and access rules per user.
What does cybersecurity from VirtuoLab cost?
Cybersecurity from VirtuoLab always gets a fixed price upfront, based on what needs securing. VirtuoLab does not quote a standard amount here, because a single WordPress site and an environment with a web app, two servers and a mail server differ too much. The route is always the same, though. First a free intro call, in which you explain which systems you have and what worries you. Then a security check at a fixed price, ending in a prioritised report. Based on that report you get a fixed price for fixing the findings, and you choose what happens. Ongoing management, such as updates, backups and monitoring, can then be arranged per month. That way you do not pay for measures that do not fit your risk. A business that processes customers' personal data, for example, has different priorities than a business with only an informational website.
