Which service fits your situation
| Your situation | What we do |
|---|---|
| A client or tender asks for a security test of your app. | Penetration test |
| An agency or freelancer built your app, and nobody checks its security. | Code check, then monthly watch |
| Your app was built fast, partly with AI coding tools. | Code check and penetration test |
| Your data runs in the cloud, and nobody reviews the settings. | Cloud check |
| You do not know what your company shows on the internet. | Exposure scan |
| An auditor or client asks for ISO 27001 or SOC 2 evidence. | Audit evidence |
| You want it handled every month, not checked once. | Managed cyber security |
What we do for your company
Penetration test.
Our software attacks your website, web app or API with the methods hackers use. You get a report you can share with clients and auditors.
Code check.
We check the code your team, your agency or AI tools wrote. We look for security flaws, leaked passwords and keys, and open-source parts with known holes or malware.
Cloud check.
We check your AWS, Azure or Google Cloud settings for data left open. We also check your server set-up files before they go live.
Exposure scan.
We list what your company shows on the internet, such as domains and servers. We watch that list for changes.
Live protection.
We add a firewall inside your app that blocks attacks while it runs. We also block malicious packages before your developers install them.
Audit evidence.
We collect the proof for the technical controls of ISO 27001 and SOC 2. You hand it to your auditor, or use it to answer a client’s security questionnaire.
Monthly watch.
Every month we review the latest code, cloud and exposure checks and the fixes your team finished. You get a one-page report in plain English.
For many findings we prepare the fix. Your developers review it before it goes live.
What is not included
- Antivirus and device management for laptops and phones.
- Email filtering and phishing tests.
- Your office network, Wi-Fi and firewall hardware.
- Microsoft 365 and Google Workspace settings.
- A 24/7 emergency response team.
When you do not need this
If your company only uses standard software, such as Microsoft 365 and an accounting package, and runs no website or app of its own, there is nothing for us to test. Your risk then sits with people and data rules. Start with the course Shadow AI and safe AI use or a shadow AI assessment.
How it works
Scoping call, 30 minutes. We list your website, apps, code and cloud accounts, and who builds them.
Fixed quote. Within 2 working days you get a written scope and a fixed price. Before any test, you confirm in writing that you may let us test every system in it.
First check. We run the checks, sort the findings by real risk and agree a fix list with your developers or agency.
Price
- Penetration test: a fixed price per test.
- Code, cloud or exposure check: a fixed price per check.
- Managed cyber security: a fixed monthly price for the monthly watch, including the code, cloud and exposure checks. Penetration tests, live protection and audit evidence are quoted separately.
Questions
Does this cover NIS2 or ISO 27001?
Only the technical part. Our checks cover technical controls. Policies, processes and staff training make up the rest.
Is the penetration test done by people or by software?
By software that runs automated attacks. We review every finding before it goes in your report. If your client or insurer requires a test by people, check with them first.
What if a test disrupts our app?
We test a test or staging version of your app. We test the live version only when you and we agree in writing. Automated attacks can slow down or interrupt an app, so you make a backup first. If a serious problem shows up, we pause or slow the test as soon as we can.
Our app holds patient or financial data. Can you test it?
Yes, on a test version with that data removed or masked. Live protection and tests of the live app need a separate written agreement first.
Who sees our code?
We do, and the security software we use. Your code is scanned in an isolated environment, and the copy used for the scan is removed afterwards. Findings and reports are kept while the service runs, and deleted after it ends within the periods in our data processing agreement. We keep all of it confidential (general terms, article 11).
Request a scoping call
We reply within 1 working day.