Karacena

BACKGROUND

Introduce your business and what you do there.

I’m the VP of innovation at Future Processing, a tech strategy advisor and delivery partner. We help businesses in regulated industries transform operations using AI-enabled solutions, modernize legacy systems, and achieve measurable outcomes through expert consulting and software development.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Karacena?

One of our clients, a B2B SaaS company whose platform processes financial data for its customers, needed a SOC 1 Type II report. Both its investors and a key enterprise customer required it. The client is a small, fully remote team with no dedicated security or compliance function. Its policies existed but were not consistently applied, and there was no evidence trail an auditor could rely on.
We didn’t have an available in-house GRC team, so we needed a partner that could deliver the full SOC 1 readiness program with us. That meant assessing gaps, designing controls, documenting processes, and preparing the audit evidence, all before the observation period started.

SOLUTION

What was the scope of their involvement?

Karacena worked as an embedded part of our delivery team. The engagement had two phases.

• Phase 1: Readiness assessment. This covered a pre-workshop questionnaire, a documentation review, and a discovery workshop with the client's leadership. The output was a SOC 1 Type II readiness assessment (gaps, key risks, proposed control objectives) and a roadmap to audit covering sequencing, owners, required evidence, and the entry criteria for the observation period.
• Phase 2: Control design and implementation support. Karacena produced a complete set of documents written as the client's own internal documents, so the client could adopt them and present them directly to the auditor:Karacena also worked directly with the client's CPA firm and compliance platform. They analyzed the custom business process controls and recommended changes to each requirement, and they joined weekly stand-ups throughout the phase.

What is the team composition?

We worked with 2–5 teammates from Karacena.

How did you come to work with Karacena?

We found them through a referral. We chose them over other options because they had high ratings, were close to my geographic location, their pricing fit our budget, and their company values aligned with ours.

What is the status of this engagement?

We worked together from May–October 2026.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

In about three months, the client went from ad hoc practices with no audit trail to a documented control environment it runs itself. It’s now on track to obtain the SOC 1 Type II report its investors and a key enterprise customer require. Karacena delivered more than 20 audit-ready documents and procedures, and the client's leadership has approved and adopted them as its own. Its risk committee is operational and maintains the risk register without outside help.
The work also improved security, not just documentation. The client's first formal access review covered 43 decisions and uncovered stale accounts, active API keys that were no longer needed, overly broad permissions, and orphaned cloud bindings. All of them are now being fixed or formally risk-accepted. The first BC/DR tabletop exercise produced a concrete remediation plan.
On the audit side, 143 evidence files are mapped to the auditor's requests, and the first evidence packages are ready to upload. Karacena also aligned the audit scope with how the platform actually operates. With two irrelevant control objectives removed, the client has fewer controls to operate throughout the observation period and a lower risk of exceptions in the final report.

How did Karacena perform from a project management standpoint?

They were very well organized. Karacena ran weekly stand-ups with the client, used Slack for day-to-day questions, and kept a clear list of open items with owners. When the client's input was delayed, they kept moving on work that didn’t depend on it, so the timeline held. They adapted quickly when the auditor's position changed during the project, and they updated every affected document consistently.

What did you find most impressive about them?

The combination of deep SOC 1 knowledge and practical delivery. The documentation was written for the client's real processes, not copied from templates, and it was ready to hand to an auditor. Karacena also worked seamlessly under our brand, which let us offer a compliance service we don't have in-house.

Are there any areas they could improve?

Some early documents were more comprehensive than a team of this size needed, and a few had to be tied to the SOC 1 mini at the client's request. With small clients, it helps to agree on the expected depth of each document upfront.

BACKGROUND

Please describe your company and position.

I am the CEO of Novaris Sp z o.o.

Describe what your company does in a single sentence.

Novaris equals technology and experience. Since 2008, we have been working on implementing and developing comprehensively existing IT systems, providing consulting services and outsourcing IT. I am proud that we are still implementing the Client’s projects who we had started cooperation with at the start of our company. We are defined not by the titles or the positions but by the joint values, such as honesty, transparency, cooperation and partnership.
Because of that we pursue clearly determined goals, engaging ourselves into even the most demanding challenges. We distinguish ourselves by ambition, devotion, determination and sense of responsibility. We place importance on development, thus we are constantly perfecting our skills.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Karacena to accomplish?

We needed experienced CISO-level expertise without the cost of a full-time hire. Just as importantly, we needed someone who could help us maintain our ISO 27001:2022 requirements throughout the year, not just prepare for an audit. We also regularly receive security questionnaires and due diligence requests from clients and partners.
Handling these internally was time-consuming and answers were not always consistent, depending on who was involved. We wanted a partner who could take ownership of this area and make the process more structured.

SOLUTION

How did you find Karacena?

Referral

Why did you select Karacena over others?

• Pricing fit our budget
• Good value for cost
• Referred to me

How many teammates from Karacena were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

Novaris engaged Karacena to act as our vCISO - an outsourced, senior-level cybersecurity function that we did not have the scale to build in-house. Karacena works as an extension of our team.
Beyond ongoing advisory work, they are directly involved in maintaining our ISO 27001:2022 controls, help us respond to security questionnaires and due diligence requests from our clients, and support us with incident preparedness. This has included running a tabletop incident response exercise with our team and helping us define recovery time and recovery point objectives (RTO/RPO) for critical systems.
Karacena provides a dedicated vCISO and ongoing operational support, including:

• maintaining and operationalizing our ISO 27001:2022 controls between audit cycles
• handling security and due diligence questionnaires from our clients
• cybersecurity risk management and prioritization 
• development and review of security policies and procedures 
• a tabletop incident response exercise with our team defining RTO/RPO for our critical systems guidance for our IT and management teams 
• management-level cybersecurity reporting

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

The biggest change is that our ISO 27001:2022 controls are now maintained throughout the year instead of becoming a major focus only before an audit. We have clearer ownership and a more consistent process for keeping our ISMS up to date. Client security questionnaires also take less internal effort. Previously, answers could vary depending on who was completing them.
We now have a structured process and a consistent set of information to work from, which makes responding much more efficient. We also have a tested incident response process rather than just documentation. The tabletop exercise identified gaps in our escalation process that we subsequently addressed. We also defined RTO and RPO targets for critical systems, which we did not have before the engagement.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Very effective. Communication is direct, and when something urgent comes up between scheduled meetings, we can reach out and get it prioritized appropriately. Meetings are focused on decisions, open issues, and next steps. Karacena also communicates well with both our technical team and management, which is important in a vCISO engagement.  

What was your primary form of communication with Karacena?

Virtual Meeting

What did you find most impressive or unique about this company?

Their level of operational involvement. Karacena does not limit the engagement to recommendations. They help us prepare responses to client security questionnaires, ran the tabletop exercise with our team, and work with us throughout the year to maintain our ISO 27001:2022 controls. That combination of CISO-level guidance and hands-on support is the main reason the model works well for us.

Are there any areas for improvement or something Karacena could have done differently?

Because the engagement is retainer-based with a capped number of hours per month, larger one-off pieces of work, such as the tabletop exercise, need to be planned in advance so they do not compete with the regular monthly workload. This has not caused any significant issues, but it is something we now take into account when planning larger activities.

BACKGROUND

Please describe your company and position.

I am the principal of Primary School No. 381 named after KK Baczyński

Describe what your company does in a single sentence.

Education. I am the principal of Primary School No. 381 named after K.K. Baczyński in Warsaw. The school educates students in grades 1-8 and employs several dozen people. As principal, I am responsible for, among other things, school organization and student safety, including cybersecurity activities.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Karacena to accomplish?

• Training
• More information
• Responsibility

SOLUTION

What specific goals or objectives did you hire Karacena to accomplish?

• Training
• More information
• Responsibility

SOLUTION

How did you find Karacena?

• Referral
• Clutch Site

Why did you select Karacena over others?

Good value for cost

How many teammates from Karacena were assigned to this project?

1 Employee

Describe the scope of work in detail. Please include a summary of key deliverables.

Karacena conducted a two-hour training session for 35 teachers in May 2026. The program included: recognizing phishing and smishing with practical exercises based on examples, a step-by-step procedure for responding to a student report, including information on who to report the matter to and in what order, and a section on cyberbullying and grooming, clearly indicating where the teacher's role ends and what they should do next. After the training, each participant received a package of materials: a card ready to use in class with students, a framework for incident procedures to be completed by the school, and a list of external resources.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

The incident procedure framework provided by Karacena became the basis for developing the school's documentation in this area. Teachers now know what to say to a student who reports an online issue and what to do next. A card with the three cybersecurity myths was distributed to several classes for homeroom hours. The training was well-prepared – the instructor was familiar with the specifics of school work and spoke to teachers in understandable, non-technical language. Implementation was timely and as agreed.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

I wanted teachers to know what to do when a student reports an online problem—how to talk to them, who to escalate the issue to, and how to distinguish between situations requiring an urgent response and those that can be discussed calmly. We lacked practical knowledge and a ready-made procedure. I was looking for specific training—not lecture-based—that would conclude with materials for use in the classroom, not just slides.

What was your primary form of communication with Karacena?

In-Person Meeting

What did you find most impressive or unique about this company?

Professional cybersecurity training for the teaching staff - they were practical and well-prepared.

Are there any areas for improvement or something Karacena could have done differently?

The only area for development could be an additional version of the materials for schools that would like to independently revisit the topic during short meetings with teachers after the training. The training itself was very well conducted, but such a refresher package would facilitate the implementation of the knowledge in subsequent weeks.

BACKGROUND

Please describe your company and position.

 I am the Senior Director, Information Security of an information technology company 

Describe what your company does in a single sentence.

We enable IT providers to lead with confidence by unifying innovation, automation, and community—driving secure, scalable, and profitable growth.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Karacena to accomplish?

• Build and Implement a global Threat Hunting function within the Information Security group.
• Build and Implement a global Red Teaming function within the Information Security group.

SOLUTION

How did you find Karacena?

Other

Why did you select Karacena over others?

• High ratings
• Referred to me
• Company values aligned

How many teammates from Karacena were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

Establish the Red Team and Threat Hunting programs. Craft detailed program charters outlining business needs, organizational goals, KPIs and performance metrics for each. Then, operate and facilitate these functions and display measured risk reduction over time as well as matured program capabilities.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

Measured and displayed risk reduction through the finding of vulnerabilities and misconfigurations. Testing the people, process and technology resposible for providing infosec capaiblities to ensure continuity and validitiy. Measured and improved program maturity over the years by selecting appropriate industry frameworks and selecting business aligned maturity goals for improvement.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Communication and project managemet were excellent throughout the duration of the project. All artifacts were properly docuement and recorded for posterity and audit. The team was able to partner cross-functionaly to accomplish remediations across the org.

What was your primary form of communication with Karacena?

Virtual Meeting

What did you find most impressive or unique about this company?

Consumate professionals with a wide breadth of knowledge and ability.

Are there any areas for improvement or something Karacena could have done differently?

They are excellent professionals who would be a valued asset to anyone who hires them.

BACKGROUND

Please describe your company and position.

I am the CTO & Co-founder of Monethic

Describe what your company does in a single sentence.

Offensive cybersecurity - red teaming, penetration testing, blockchains and smart contract auditing.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Karacena to accomplish?

• Guide and empower Client SOC
• SOC training for the Client
• Incident response handling

SOLUTION

How did you find Karacena?

Referral

Why did you select Karacena over others?

• Close to my geographic location
• Good value for cost
• Company values aligned

How many teammates from Karacena were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

As a co-owner of the pentesting/offensive cybersecurity company Monethic, I led a Purple Team exercise in 2025 for a large U.S.-based technology company with over 10,000 employees. My team handled the red team scope, designing attack scenarios and conducting privilege escalation and network infiltration simulations aligned with the MITRE ATT&CK framework.

Karacena P.S.A. joined the project to strengthen the client’s SOC and build out the Blue Team capabilities. Their team focused on threat hunting, ongoing SIEM/EDR telemetry analysis, and real-time incident response during our simulations. They worked closely with the client’s SOC on triage, escalation, and post-incident investigations. After the exercise, they delivered tailored detection rules and security policy improvements adapted to the client’s environment.

The collaboration reflected a true purple teaming approach: our offensive scenarios were immediately tested against defensive controls, with continuous feedback between teams. Karacena also conducted incident response workshops for the client’s SOC analysts, helping them improve practical skills and develop playbooks for specific threat scenarios.

As a result, MTTD was reduced by over 40% and MTTR by 30%. We identified 25 critical configuration issues, all of which were remediated within 60 days. The SOC implemented 15 new detection rules, leading to a noticeable reduction in false positives.

Karacena demonstrated solid expertise in threat hunting, incident response, and detection engineering. I would recommend them to organizations looking to run structured Purple Team engagements and strengthen their SOC capabilities.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

Mean Time to Detect (MTTD) was reduced by over 40% and MTTR by 30%. We identified 25 critical configuration issues, all of which were remediated within 60 days. The SOC implemented 15 new detection rules, leading to a noticeable reduction in false positives.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Karacena demonstrated outstanding expertise in threat hunting, incident response, and security policy development. Combining their defensive strengths with our offensive experience resulted in a true Purple Team engagement that enabled the client to understand its weaknesses and significantly improve its security posture.

What was your primary form of communication with Karacena?

Virtual Meeting

What did you find most impressive or unique about this company?

They combined hands-on threat hunting and incident response expertise with a practical understanding of real-world attack techniques, which made the collaboration during the Purple Team exercise particularly effective.

Are there any areas for improvement or something Karacena could have done differently?

Nothing significant - the engagement met expectations.

BACKGROUND

Please describe your company and position.

I am the Co-Owner of Mobipol

Describe what your company does in a single sentence.

Authorised distributor of ExxonMobil in Poland.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Karacena to accomplish?

• Assessment of the current state of company's cybersecurity
• Enhancing cybersecurity in the organization

SOLUTION

How did you find Karacena?

Referral

Why did you select Karacena over others?

• High ratings
• Close to my geographic location
• Pricing fit our budget
• Great culture fit
• Referred to me

How many teammates from Karacena were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

The cybersecurity audit conducted in our organization aimed to assess the current level of organizational and technical safeguards, identify key risk areas, and verify compliance with best practices in information security.

The scope of the audit included both organizational and technical aspects related to the processing, storage, and protection of information—such as IT asset management, policies and procedures, physical security, employee awareness, backups, system updates, access management, and incident response.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

Audit report that embraced 29 control points.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

The audit was conducted professionally and efficiently, and the collaboration was smooth and constructive throughout.

We particularly appreciated the high quality of the final report – it was clear, logically structured, and understandable even to those without an IT background. The recommendations provided were precise and prioritized, enabling us to take swift and effective corrective actions.

The audit gave us valuable insight into areas requiring improvement and serves as a strong foundation for further enhancing our organization's security posture.

What was your primary form of communication with Karacena?

• In-Person Meeting
• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

What impressed us most about this company was their high level of professionalism, both in terms of expertise and organizational culture. The project was carried out efficiently and completed on time, exactly as agreed. Their commitment, responsiveness, and clear communication made the entire collaboration smooth and highly effective.

We particularly appreciated the high quality of the final report – it was clear, logically structured, and understandable even to those without an IT background. The recommendations provided were precise and prioritized, enabling us to take swift and effective corrective actions.

Are there any areas for improvement or something Karacena could have done differently?

No, we recommend this company to anyone interesting in enhancing cubersecurity in their organization.