External attack surface
See what an attacker can reach. We examine exposed assets, services and configurations for exploitable weaknesses.
- Domains & exposed services
- Security misconfigurations
- Unintended data exposure
Security testing. Real accountability.
Find the gaps.
Before they
find you.
Our own AI-powered product tests your web apps, APIs and attack surface in days, not weeks.
Every vulnerability is confirmed with evidence.
You pay only for what we find.
No vulnerabilities found? Nothing to pay.
From signing the agreement to your report: up to one week. We deliver 90% of reports within one day.
Security testing with a stake in the outcome.
Pay per confirmed vulnerability.
Severity determines the price.
Your attack surface.
Seen from every angle.
From what’s exposed to the internet to what sits behind authentication. We test how your systems can actually be exploited.
Public APIs
Test the boundaries of your application. We check whether public-facing endpoints protect your data and business logic.
- Authentication & authorization
- Injection & input handling
- Business logic abuse
Internal APIs
Go beyond the perimeter. We investigate trust between services and what an authenticated user can really access.
- Roles & access boundaries
- Privilege escalation
- Service-to-service exposure
A different way to pay for security
Every finding.
A clear price.
You pay a fixed price for each confirmed vulnerability, set by its severity, and never more than the cap agreed for your scope.
Let’s define your scope0
No findings. No fee.
If we find no vulnerabilities,
you pay nothing for the audit.
Confirmed findingsPriced by severity
Low$50Medium$150High$400Critical$700
Severity assessed using CVSS. Informational findings and hardening advice are free. Evidence for every finding.
Price caps by scope
The cap depends on what we test, not on the size of your company. We agree on the scope and the cap in writing before testing starts.
All amounts are in US dollars (USD). Prices and audit fee caps exclude applicable taxes. Any tax due will be shown separately on your invoice.
Your agreed cap is the maximum audit fee before applicable taxes. If the findings add up to more, every additional confirmed vulnerability is still included in your report at no extra charge.
- One web application or API (up to ~50 endpoints, 2 user roles)
- Up to $1,500
- Up to 3 applications or APIs, or up to ~200 endpoints
- Up to $4,000
- Larger scope
- Individual cap, from $8,000
Example: a test of one API finds 1 High, 3 Medium and 5 Low vulnerabilities. The invoice is $400 + $450 + $250 = $1,100, below the $1,500 cap. If the same test finds nothing, you pay nothing.
A finding you
can act on.
This is a real, anonymized client assessment. Client identifiers and sensitive evidence are redacted, and some findings have been removed to protect confidentiality.
31 pages · English · Anonymized
Report finding CRIT-01Critical · CVSS 9.3
CORS misconfiguration with credentials
Web application / Access control · CWE-942
Another website could read your users’ data.
The server reflects any requesting origin and allows credentials. If a signed-in user opens a malicious website, that site may read sensitive authenticated responses, provided the browser sends the user’s credentials and the endpoint accepts the request.
Any origin reflected, with credentials allowed.
The report records responses that return the requesting origin in the Access-Control-Allow-Origin header together with Access-Control-Allow-Credentials: true.
Client-specific responses and reproduction evidence are redacted in the downloadable sample. This page summarizes the assessment; it is not a live test.
Headers alone do not prove exploitation: cookie policy, endpoint authentication and request tokens decide whether data can be read, and the redacted sample does not demonstrate them.
Allow only your own origins.
Return Access-Control-Allow-Origin only for an explicit allowlist of your own domains, and remove Access-Control-Allow-Credentials unless your own frontend needs it. Check plugins that add CORS headers on their own. Then repeat the request with an arbitrary Origin: the response must not contain Access-Control-Allow-Origin.
From first conversation
to a clear fix.
A focused engagement that gives your team the evidence and direction to act.
Agree on the scope
We define the assets, access, testing boundaries and the price cap together.
Test. Then verify.
We investigate weaknesses and validate findings with reproducible evidence and real-world impact.
Know what to fix
Receive a prioritized report with reproduction steps and practical remediation guidance.
A few things
worth knowing.
What counts as a finding?
A confirmed vulnerability supported by reproducible evidence and an assessment of its impact. Severity is assessed using CVSS; finding acceptance criteria are agreed before the audit.
How much will the audit cost?
You pay a fixed price per confirmed vulnerability: Critical $700, High $400, Medium $150, Low $50. Informational findings are free. The total never exceeds the cap for your scope: $1,500 for one application or API, $4,000 for up to three, an individual cap for larger scopes. Confirmed vulnerabilities above the cap are still in your report at no extra charge. If we find no vulnerabilities, you pay nothing.
Do you use AI?
Yes. Our own product, built on large language models, speeds up the testing. Every vulnerability is reproduced and confirmed with evidence before it reaches your report, and with access to your source code we can also fix what we find.
Can you test systems behind a login?
Yes. Internal and authenticated API testing is part of our coverage. We agree on the accounts, roles and access needed during scoping.
How long does testing take?
From signing the agreement to your report: up to one week. We deliver 90% of reports within one day.
What will my team receive?
A report with confirmed vulnerabilities, severity, impact, reproduction steps and recommendations for fixing them.
Let’s look closer
Your next security
move starts here.
Tell us what you’re building.
We’ll help you define what to test.