Security hardening
Agree changes to the relevant deployed runtime or dependencies, access, configuration and staging protection. Verify the deployed result against agreed critical user flows. The quote lists the exact systems, permissions and work.
Website Security Check
Know what is exposed. Test what matters. Give your developer clear next steps.
From the public face of a website to account permissions and controlled attack paths, choose the depth your business needs. Every assessment includes reviewed evidence, practical fix guidance and one free focused retest.
Surface Security Review: €400 + VAT. Scope and suitability confirmed before booking.
Already have an audit, report or security alert?
We check which reported issues apply to your deployed application and are reachable, then prioritize actionable work. You decide which fixes to proceed with; review, remediation and verification are agreed and quoted separately.
We provide evidence-backed status, what was fixed and verified, and open items or scope we could not verify. For runtime or dependency alerts, we use suitable provider or deployment evidence to identify affected versions, then check the deployed version and agreed critical user flows. We do not treat every scanner or model alert as a confirmed issue.
Examples we can scope
- Whether staging access and protection are configured as intended.
- Whether sensitive content is publicly exposed, including legacy cached content.
- Whether CI checks help prevent an agreed issue from returning.
Targeted fixes remain €70/hour or €400 per booked day, excluding VAT, with the work and spending limit agreed first. Ordinary defects in our own delivery are not charged again. An enquiry does not authorize testing or remediation; do not send credentials or sensitive vulnerability evidence.
You can request review of an existing report or targeted fixes without buying a new assessment package.
Discuss an existing report or alertSecurity hardening & incident reporting support
Quote-based technical support, available without booking an assessment. We agree the exact systems, permissions, scope, capacity and timing before work starts.
Incident reporting support
Prepare technical material for your reporting process: a timeline, evidenced facts and unknowns, affected services or data where established, a corrective-actions log, and a technical handoff for you and any DPO or legal adviser you appoint. Before work could change relevant logs or state, we agree what to preserve and coordinate with you, any adviser you appoint and any incident responder you engage.
You remain responsible for reporting decisions, recipients and submissions, with support from any appointed DPO or legal adviser. We provide technical input and do not submit notifications or contact affected people automatically.
Agreed hardening may use the existing targeted-remediation rates: €70/hour or €400 per booked day, excluding VAT. Incident documentation is separately scoped and quoted. Ordinary defects in our own delivery are not charged again.
This is technical support, not legal advice or GDPR certification. A vulnerability alone does not establish a personal-data breach, and not every incident involves personal data. No blanket forensic investigation or 24/7 emergency response is offered.
Please do not send credentials, sensitive system details or incident evidence through the public contact form. We agree secure evidence handling separately.
Request a quote for security supportChoose the depth of the assessment
All prices exclude VAT. A workflow means an agreed sequence, such as signing in, opening a customer project or changing a user's permissions. It names operations, roles and expected outcomes, not every function of an application.
Surface Security Review
€400 + VAT
What does your website expose publicly? A suitable starting point for a brochure website.
What we check
One website, up to two exact public hostnames and one optional email domain.
Low-impact public exposure and configuration checks: TLS for each hostname, redirects, relevant browser, cookie and email controls, and exposed content. No login or exploitation.
Validated findings and explicit public-only coverage. Extra scope is quoted first.
What you receive
- Private interactive HTML report and readable A4 PDF, with reviewed evidence and priorities.
- Developer backlog, implementation briefs, acceptance tests, coverage and ticket/CSV/report-data exports.
A results discussion and one free focused retest of original findings, requested within 30 days of report delivery. We schedule the retest separately. New assets, features and repeated testing are separately scoped.
Request a scoped quoteDeep Security Assessment
From €800 + VAT
Do login, permissions and important workflows hold up? Our main offer for suitable applications with user accounts.
What we check
One deployment, up to two hosts, three named workflows and two roles, using controlled accounts, test data and supplied configuration evidence.
Public checks plus bounded active tests of sessions, object and role permissions, input handling and business rules. Agreed test tenants and application authorization boundaries can be included.
We quote the actual accounts, workflows and evidence before booking. Missing access is reported as incomplete scope; a public-only run is not a completed Deep assessment.
What you receive
- Private interactive HTML report and readable A4 PDF, with reviewed evidence and priorities.
- Developer backlog, implementation briefs, acceptance tests, coverage and ticket/CSV/report-data exports.
A results discussion and one free focused retest of original findings, requested within 30 days of report delivery. We schedule the retest separately. New assets, features and repeated testing are separately scoped.
Request a scoped quoteAdversarial Security Assessment
From €1,600 + VAT
How far could an attacker actually get? For buyers who need demonstrated exploitation and combined impact.
What we check
A quoted attack plan for one deployment, normally up to five explicitly authorized hosts or services, five workflows and three roles. The quote fixes the exact assets, cases, effort and permitted impact.
Scoped penetration testing through controlled exploitation, privilege-boundary checks and tested attack chains. Reported impact, detection observations and cleanup evidence are tied to the tests performed.
The starting price covers a focused agreed plan, not the entire upper scope ceiling. Applicable SQL injection, SSRF, temporary command execution or privilege escalation proofs require explicit authorization.
What you receive
- Private interactive HTML report and readable A4 PDF, with reviewed evidence and priorities.
- Developer backlog, implementation briefs, acceptance tests, coverage and ticket/CSV/report-data exports.
A results discussion and one free focused retest of original findings, requested within 30 days of report delivery. We schedule the retest separately. New assets, features and repeated testing are separately scoped.
Request a scoped quoteOptional targeted remediation
€70/hour or €400 per booked day, excluding VAT
Every assessment includes fix guidance. Implementation is separate, with agreed work and a spending limit. Four hours cost €280 in total, including the investigation, changes, code review, rollback preparation and regression checks that fit that allowance. We define the working-day duration and billing basis in the quote. We do not charge the same work twice or promise to fix every finding.
How the assessment works
- 01
Agree the boundaries
We test only owned or owner-authorized assets. We agree the methods, test window, permitted effects, stop conditions and cleanup before testing. Dates follow scope and access approval.
- 02
Test and validate
We follow the agreed plan and validate findings against reproducible evidence. We separate vulnerabilities, hardening opportunities, positive controls and inconclusive checks. Missing access stays visible as incomplete coverage.
- 03
Discuss and recheck
A results discussion and one free focused retest of original findings, requested within 30 days of report delivery. We schedule the retest separately. New assets, features and repeated testing are separately scoped.
Useful evidence. Clear next actions.
Every tier includes the same quality of private, self-contained interactive HTML report and A4 PDF. Dedicated Overview, Findings, Developers, Coverage and Attack paths sections keep the business decisions and complete technical detail accessible.
Findings include impact, confidence, reviewed reproducible evidence, concrete fix guidance and negative plus legitimate acceptance checks. Developers receive a backlog and implementation briefs, with ticket, CSV and report-data exports. Coverage shows tested, incomplete, excluded and not-tested areas. Tested attack paths are separate from hypotheses. A clean result applies only to the recorded scope; a finding count is not a security score.
Clear limits, honest coverage
Surface has no login or exploitation. Deep adds bounded authenticated checks. Adversarial includes controlled exploitation under the agreed attack plan. None promises comprehensive security, certification, guaranteed compromise discovery or blanket OWASP coverage.
Destructive availability tests, persistence, real-data extraction, social engineering and unrelated third-party systems are outside the default offer. Broad network or Active Directory work, entire complex multi-tenant platforms, payment-provider systems and embedded or firmware work need separate specialist scoping. Agreed application authorization and controlled test-tenant checks can be included in Deep or Adversarial.
Separate from ongoing Care
Care covers ongoing hosting and maintenance. An assessment adds an agreed test plan, documented coverage, reviewed findings, a results discussion and one focused retest. It can help after changes or when taking over an existing website.
Normal secure delivery remains part of our website work. We do not charge again to correct ordinary defects in our own delivery. Reviewing a site we built is not independent assurance.
See Care plansRequest a security quote
Choose the package, enter your email and send. Website and context are optional. Your request does not authorize testing or confirm a booking; we agree the exact scope, access and quote before work starts.