Build your organization's security on evidence, not assumptions.
From penetration testing to ISO 27001 and ISO 42001 consulting, from GRC compliance to awareness training, Mermur manages the entire corporate information security journey under one roof.
End-to-end information security services
From technical testing and assessment to management system consulting, a measurable and reportable approach at every step.
Penetration Testing (Pentest)
Vulnerability discovery and exploitation scenarios across web, mobile, network/infrastructure and wireless environments from a real attacker's perspective.
ISO 27001 Consulting
Information security management system implementation, risk assessment, documentation and certification readiness.
ISO 42001 Consulting
AI management system implementation; structuring AI risks, ethical principles and compliance controls.
Information Security Consulting
A roadmap tailored to your maturity level; design of policies, architecture and operational security controls.
Awareness Training
In-house training and drill programs on social engineering, phishing and secure working habits.
GRC Compliance Consulting
Establishing governance, risk and compliance processes; alignment with KVKK, GDPR and sector-specific regulations.
Incident Response
Detection, triage and response to security incidents; end-to-end support from SOC alert analysis to root cause analysis and remediation.
Our Other Areas of Expertise
Scope can be extended as neededTechnical depth combined with corporate discipline
Hands-On Expertise
A manual testing methodology that goes beyond standard scanning and mimics real attack scenarios.
Transparent Reporting
Readable, prioritized and action-oriented reports, from executive summary to technical evidence.
Mastery of Standards
Adapting ISO 27001, ISO 42001, KVKK and GDPR requirements to fit your organization's operations.
Lasting Partnership
Beyond a one-off test: sustainable security through periodic assessment and continuous improvement.
Security assessment in four steps
Discovery & Scoping
Business processes, assets and risk priorities are evaluated together to define the scope of testing or consulting.
Testing & Analysis
Vulnerabilities are identified with manual and tool-assisted methods, and impact is analyzed through real attack scenarios.
Reporting
Findings are delivered as technical and executive reports with risk level, business impact and remediation recommendations.
Action & Verification
Remediated findings are retested; a roadmap is created for improvement and continuous monitoring.
Standards and regulatory compliance
Get in touch
Briefly describe your needs and we'll get back to you within 1 business day with a suitable scope and proposal.