Security
Information security audit
We find vulnerabilities before someone else does. Quick scan in three days, full audit or pentest. You get a prioritised risk map and a remediation plan with an estimate.
External perimeter, web app, common misconfigurations.
OWASP Top 10, ASVS and WSTG for web, PTES for infrastructure.
Active checks are agreed in advance and never break production.
Find, assess, fix: no hand-offs between vendors.
Who needs it
If you have accounts, payments, an API or customer data, you have something to lose.
Fintech and e-commerce
Payments, accounts, loyalty programmes. Bank and payment scheme requirements.
SaaS and marketplaces
Multi-tenancy, APIs, partner integrations. One flaw affects every customer.
Healthcare and education
Special categories of personal data and stricter protection requirements.
Before a deal or launch
An investor or enterprise customer asks for proof of security.
What we check
Three depth levels
Pick the level for the task and budget. Each level includes the previous one.
Quick scan
External perimeter, open ports and services, security headers, TLS, leaked configs, known vulnerable components. 3 business days.
Web application
Authentication and sessions, access control, injections, business logic, API, file uploads. Manual testing per OWASP WSTG.
Infrastructure
Servers, containers, clouds, CI/CD, secrets, backups, staff access.
Pentest
Simulated attack: external, internal, social engineering by agreement. Report with proof of exploitation.
What you get
Not a list of CVEs but a clear plan: what to fix first and what it costs.
- Risk map with severity and exploitability
- Evidence for every finding: steps, screenshots
- Fix recommendations for your stack
- Prioritised remediation plan and an estimate for our team
- Free re-test of fixed items
- Executive summary for management and investors
How the audit works
- 130 minutes
Call and scope
What we test, what is off-limits, windows for active checks.
- 21–2 days
Recon and scanning
Automated collection, then manual verification.
- 33–10 days
Manual testing
Business logic, access control, vulnerability chains.
- 41 day
Report and debrief
Risk map, plan, estimate. A call with your team.
Formats and pricing
Fixed price after the first call.
Quick scan
fixedA site or one app
- External perimeter
- Headers, TLS, configs
- Known vulnerabilities
- 3 business days
Full audit
quotedApp and infrastructure
- Everything in Quick scan
- Manual OWASP testing
- Infrastructure and CI/CD
- Plan and estimate
- 2–3 weeks
Pentest
quotedSimulated attack
- Everything in Full audit
- Exploitation with evidence
- Social engineering by agreement
- Re-test
Formal certification against regulator standards is done with a licensed partner. No licence is required for audits in the private sector.
FAQ
Let's talk
An estimate within one business day. No spam, no sales calls.