Security testing for businesses · With the owner’s written permission
Can your website be hacked? We check it free of charge.
For businesses and professionals only. If we find no problems, you receive the report free of charge as well. You pay for the report only when we find problems, and its price depends on how many there are and how serious they are. We test websites, applications, infrastructure, AI systems and smart contracts the way a real attacker would.
For businesses. The check of your website costs nothing. If we find no vulnerabilities, the report is free of charge as well. The report is paid only when we find vulnerabilities, and its price depends on their number and severity.
01
You send the address
And confirm that the website is yours. Before the check, the owner signs an authorisation with the address and the dates.
02
We check the website
From the outside, the way an attacker sees it, in 1 to 5 business days after the authorisation is signed. Without destructive actions and without load tests.
03
You receive the result
No problems: a free report. Problems found: their number, their severity and the price of the report. The report comes immediately after payment; the retest after the fixes is free.
Offensive security is a service only when it is authorised. These rules apply to every engagement and to every bug bounty report, without exceptions.
01
Written authorisation first
Testing starts after the asset owner has signed the authorisation and the scope. We verify that the signatory is entitled to sign.
02
Scope is a boundary
We touch what is listed and nothing else. Systems of third parties are tested only with the consent of their operator.
03
Verified programs only
On our bug bounty platform a program is published only after its owner has been verified, and every report is examined against the rules of the program.
04
Evidence over opinion
A finding is reported once it has been reproduced. It carries proof, impact, a CVSS 4.0 vector and remediation steps.
05
Minimal footprint
We prove impact with the least intrusive action, stay away from production data and stop when a stop condition is met.
06
Confidential by default
Findings belong to the client. Nothing is disclosed or published without written consent.
03Services
What we test
From a single web application to a full adversary simulation. Each service has a defined method, a defined deliverable and a price fixed before work starts.
An external security check of one business website, free of charge, with a report that is paid only when vulnerabilities are found. For businesses only.
The report is the product. Every finding in it is reproduced once more from its evidence before the report reaches you.
Executive summary
Risk in business terms, the state of the system and the priorities, on two pages.
Scope and method
What was tested, when, from where, with which accounts, and what stayed out of scope.
Findings
One entry per issue: description, evidence, reproduction, impact, CVSS 4.0 vector, CWE, fix.
Attack paths
How separate weaknesses chain into a compromise, step by step.
Remediation plan
Fixes ordered by the risk they remove and the effort they take.
Retest results
The status of every finding after the fix, and the attestation letter.
06Engagement models
Ways to work with us
The model follows the maturity of the system and the pace of its releases.
Free website check
An external check of one website. You learn whether it is open to common attacks before you spend anything.
Fits
A first look at the security of a public website.
Pricing
Free of charge. The report is paid only when vulnerabilities are found; its price depends on their number and severity.
Fixed-scope assessment
A defined set of assets is tested once, with a report and a retest.
Fits
Releases, audits, due diligence, compliance deadlines.
Pricing
Fixed price for the agreed scope.
Continuous testing
We test every significant change and re-examine the perimeter on a schedule.
Fits
Products that ship every week.
Pricing
Monthly fee for an agreed volume of testing.
Pay for results
A private, time-boxed search for vulnerabilities carried out by us. You pay for confirmed vulnerabilities according to a reward table agreed in advance.
Fits
Mature systems that have been tested before.
Pricing
Reward per confirmed finding, with a budget cap.
Program management
We design, launch and run your bug bounty or disclosure program: policy, scope, triage and communication with researchers.
Fits
Companies opening up to external researchers.
Pricing
Setup fee and a monthly management fee.
07Bug bounty
A platform where vulnerabilities are paid for under contract
Owners publish programs and name the reward. Researchers report vulnerabilities through us and are paid by us. We verify the owner, examine every report and answer for the money.
A program is published only after its owner has proved with documents that the system is theirs.
The owner sets the rewards. The researcher receives the whole reward.
Our commission is 20% of each reward and is paid by the owner. Amounts are stated without VAT; we are not registered for VAT and charge none.
Every report is examined, reproduced and rated on the CVSS 4.0 scale.
A report stays between the researcher, the owner and us.
08Standards
Methods you can look up
We work to public standards, name the version and map findings to them. Following a standard is not the same as being certified against it: a certification is listed on this site only together with a link where it can be verified.
Yes. The check itself costs nothing, and so does the report when no vulnerabilities are found. When we find vulnerabilities, you receive their number and severity free of charge and decide whether to buy the report; its price depends on the number and the severity of the findings.
Is penetration testing legal?
Yes, when the owner of the system has authorised it in writing. Without authorisation the same actions are a criminal offence in most jurisdictions. That is why every engagement starts with an authorisation letter and a scope, and why we verify that the signatory has the authority to sign.
What is the difference between a penetration test and a bug bounty?
A penetration test is a time-boxed assessment by a contracted team against an agreed scope, with a report that covers everything tested. A bug bounty is an open-ended program in which independent researchers are rewarded for valid findings. The first gives assurance at a point in time, the second gives continuous discovery. Mature organisations use both.
Will testing disrupt production?
The rules of engagement define what is allowed: test windows, request rates, excluded techniques and stop conditions. Denial-of-service testing is never performed unless you request it in writing. If we observe instability, we stop and call your contact.
How is the price determined?
By the size and complexity of the scope, the depth of testing and the access provided. After scoping you receive a fixed price; it does not change unless the scope does.
What happens to our data?
We collect the minimum evidence needed to prove a finding. Working data is stored encrypted and destroyed 30 days after the engagement is closed. Reports are delivered as encrypted archives by email, with the password sent separately by SMS or Signal.
Do you sign an NDA?
Yes. The NDA is signed before you share any detail about your systems.