A clear process, from start to finish
You will know at every moment what is being tested, when, and with what results.
Contact
You tell us what you want to protect. We reply to understand the context and goals.
Scope and agreement
We define the domains and systems included, the dates, the permitted tests and the limits.
Signed authorisation
We do not start without a document signed by the owner. More in Consent.
Audit
Reconnaissance and controlled testing following OWASP, avoiding any destructive action. If we find something critical, we tell you immediately, without waiting for the report.
Report
We deliver an executive summary for management and technical detail for your team, with evidence and recommendations.
Re-test
Once you have fixed the issues, we verify the measures work and update the report.
What we build on
- OWASP Top 10 and the OWASP Web Security Testing Guide for web testing scope.
- OWASP API Security Top 10 for APIs.
- CVSS to score the severity of each finding in a comparable way.
What the report includes
- Executive summary without jargon
- Findings with severity, evidence and how to reproduce them
- Fix recommendations ordered by priority
- Scope, dates and methodology used
An anonymised sample report will be available soon.
What people usually ask
Is it legal for you to audit my website?
Yes, as long as the system owner has expressly authorised it. That is why we sign a document before we begin. Testing without permission can be a crime.
Could you break my site or take the server down?
We work to avoid it: controlled tests, with no destructive actions or denial of service unless expressly agreed. Even so, we recommend having up-to-date backups, as with any change to production.
How long does an audit take?
It depends on size and complexity. During the scoping stage we give you an estimated timeline before we start.
What happens to my data and to what you find?
Everything we see is confidential and processed only to carry out the audit. Findings are shared only with the people you designate.
Can you audit a website built by an agency?
Yes, but we need authorisation from the website owner and, depending on the case, from the agency or the hosting provider.
How much does it cost?
It depends on scope. Tell us about your case and we will give you a concrete proposal.