Service Overview
We assess applications, their dependencies, and the way they are built and released, to find security weaknesses before attackers do. Every engagement ends with two reports - an assessment of where you stand and a post-remediation report showing the most serious issues already fixed and a prioritized plan for the rest.
How We Work
Acknowledge
Map how your systems connect, who has access and what production needs.
Assess
SBOM, SAST/DAST, fuzzing and trust boundaries, ranked by CVSS.
Fix
We fix Critical and High findings and retest each one.
Protect
Hardening, least privilege and security gates on every pull request.
What's Included
Boundary Definition
A signed scope and rules-of-engagement document covering the applications, APIs, network segments, and external connections under test.
SBOM & Supply-Chain Audit
A CycloneDX software bill of materials for the whole solution - direct, transitive, commercial, and native components - checked against package registries, the GitHub Advisory Database, OSV, and OSS-Fuzz for vulnerable, deprecated, and outdated libraries.
SAST & DAST
Static analysis of your source code regardless of language or technology stack, against OWASP Top 10 and CWE Top 25 rules, plus dynamic testing of running applications and APIs, including black-box mutation fuzzing of the interfaces that parse external input.
Architecture & Trust Boundary Analysis
Every point where data crosses between components of different trust - user and application, application and external services, vendor and customer installation - checked for identity, authorization, and integrity, along with access control, cryptography, licensing, and secrets handling.
Risk Management
Threat modeling with an established methodology such as STRIDE, with every finding scored with CVSS 3.1 and consolidated into one risk register and prioritized remediation plan, so you know exactly what to fix first.
Fixes & Hardening
We fix Critical and High findings within our control, then retest: encrypted and mutually authenticated communication, dependency upgrades, access control enforced beyond the UI, secrets moved out of source code, and regression tests for every fix.
Post-Remediation Report
A second report after the fixes: what was closed, what remains and why, and a prioritized plan for the rest - a clear record for your customers and management.
Compliance Mapping (Add-On)
On request, findings and fixes mapped to NIS2 Article 21, ISO/IEC 27001, or NIST CSF 2.0, so the reports can serve as input to your formal risk analysis.
Industrial Protocols (Add-On)
Security testing, fuzzing, and fixes for the communication between your software and industrial controllers, over OPC UA and other industrial protocols - for example encrypted channels with mutual certificate authentication. Tests run against a test harness, so no production machine is put at risk.
Security Gates Integration (Add-On)
SCA, SAST, and SBOM checks wired into your build pipeline so every release is scanned automatically, plus reproducible builds from committed code, secrets injected at build time, and SHA-256 checksums for every installer.
The Challenge
Security issues are far cheaper to fix before they're exploited than after. Our assessments show exactly where your systems are exposed, close the most serious gaps ourselves, and leave you with a before-and-after record of your security posture.
Transparent, Per-Application
Pricing
Pick the tier that matches your application's complexity
Small
Single-purpose internal tool or small API, limited attack surface
- Boundary definition & rules of engagement
- SBOM & dependency audit
- SAST & DAST
- Architecture & trust boundary analysis
- Risk management (e.g. STRIDE, CVSS) & remediation plan
- Fix implementation for Critical/High + retest
- Post-remediation report
Standard
Customer-facing app with several integrations
- Boundary definition & rules of engagement
- SBOM & dependency audit
- SAST & DAST
- Architecture & trust boundary analysis
- Risk management (e.g. STRIDE, CVSS) & remediation plan
- Fix implementation for Critical/High + retest
- Post-remediation report
Complex
Multi-service architecture or many external integrations
- Boundary definition & rules of engagement
- SBOM & dependency audit
- SAST & DAST
- Architecture & trust boundary analysis
- Risk management (e.g. STRIDE, CVSS) & remediation plan
- Fix implementation for Critical/High + retest
- Post-remediation report
Support
Frequently Asked Questions
Straight answers to what teams ask before we start working together.
How long does a cybersecurity assessment take?
A single application typically runs four to eight weeks end to end, from boundary definition through the post-remediation report. Multi-application engagements are scoped individually.
What do we receive at the end?
Two reports. The assessment report covers an executive summary, methodology, SBOM, trust-boundary analysis, CVSS-scored findings, and recommendations. The post-remediation report shows what was fixed, what remains, and what to do next. You also keep the SBOM.
How do you handle sensitive data and access?
We scope access to the minimum required, use time-boxed credentials, and sign NDAs before any assessment work starts.
Do you test production systems or only staging?
We agree the scope upfront - most engagements test staging and non-critical production paths first, then expand only with your sign-off. Fuzzing runs against a test harness, not your live environment.
Do you actually fix the vulnerabilities you find, or just report them?
Fix implementation for Critical and High findings is included in the base price of every engagement, with retesting to confirm each fix actually closes the finding. Where a fix depends on a third party or needs a larger change, such as a new file format, release signing, or a licensing redesign, we hand over a ready-to-execute remediation ticket instead of a generic recommendation.
Can the reports support NIS2 or ISO 27001 compliance?
Yes, as an add-on. We map findings and fixes to NIS2 Article 21, ISO/IEC 27001, or NIST CSF 2.0, so the reports can feed straight into your formal risk analysis and audit evidence.
What does it cost?
Pricing is per application, in three tiers based on complexity - see the Pricing section below for exact EUR rates. Add-ons - compliance mapping, industrial protocols, and security gates integration - are quoted separately.