Is the audit really free?

Yes. It costs $0, and you don't have to buy anything afterwards.

What will you look at?

One application or one cloud environment. We use your architecture notes, any redacted evidence and what is visible from the internet.

Will you try to break in?

No. The audit is a safe first review. Active testing needs its own scope and your written permission.

Can it support an investment decision?

It can raise the right questions. For a full deal review, use Technical Due Diligence, from $5,000 per engagement.

How long does it take?

It depends on what you can share with us. We agree the timing when we confirm the free scope.

What happens after the walkthrough?

You decide. If you want more help, we suggest the program that fits. You don't have to buy anything.

What does the annual price cover?

One application with its API, one cloud environment, one baseline review, one retest, four advisory sessions and monitoring for 12 months.

Your engineers, with our help. We explain each fix, then test again to prove it worked.

Do you look at our AI features?

Yes, when they're part of the application in scope. We check what your AI models or agents can do and what data they can reach.

Is ongoing monitoring included?

Yes. We monitor the systems in scope for the full 12-month term. We agree access, reporting, contacts and triage hours before it starts.

Can a bank or fintech use Business Security?

Yes, if the work fits the starting scope. Groups with several entities usually need Enterprise Security.

Will you make every fix?

We set the order, help your team and test again to prove each fix. Hands-on fixing is quoted separately.

Is this regulatory approval?

No. We map our test evidence to the controls you name. Your regulator or auditor makes the decision.

Which controls can you map our evidence to?

The ones your customers or financial regulators ask about. Tell us the controls you must meet and the evidence you already have.

Is ongoing monitoring included?

Yes. We monitor the systems in scope for the full 12-month term. We agree access, reporting, contacts and triage hours before it starts.

Does $25,000 cover every system we own?

No. The starting price covers one business unit with its applications and environments. We quote wider estates against a clear scope.

Is incident response included?

One incident response exercise is included. Live incident response and response retainers need a separate agreement.

Can we add specialist AI testing?

Yes, as an extension. We scope testing of AI agents and models around the systems your business unit runs.

Who needs to be involved on our side?

An executive sponsor, a technical lead and a risk owner, plus engineers who can make the fixes.

Is ongoing monitoring included?

Yes. We monitor the systems in scope for the full 12-month term. We agree access, reporting, contacts and triage hours before it starts.

Is the $5,000 price annual?

No. Technical Due Diligence starts at $5,000 per engagement, for one target and its main product.

Can the review support cyber insurance?

Yes. We can focus on security and recovery evidence for underwriting. The insurer decides on cover and policy terms.

What if the target can't provide evidence?

The memo records what is missing and lowers our confidence to match. We agree any change to scope or timing before extending the work.

Do you need the target's permission?

Yes. We need permission to review the target's information and a contact at the target.

Is ongoing monitoring included?

Yes. We monitor the target's systems in scope for the full engagement window. We agree access, reporting, contacts and triage hours before it starts.

Do we need to pay or sign a contract?

No. Accepted Nonprofit Defence work is free and needs no commercial agreement.

Registered nonprofits, charities and civil society groups with a public-benefit mission and someone responsible for the service.

How is this different from Public Infrastructure Security?

Nonprofit Defence serves eligible charities and civil society groups. Public Infrastructure Security serves government, parastatal and public institution services across Africa.

What do you need from us?

Someone responsible for the service, written permission for any testing and a contact who can coordinate fixes.

Is ongoing monitoring included?

Yes. We monitor the service for the full free program period. We agree access, reporting, contacts and triage hours before it starts.

Does a referral give you permission to test?

No. We can safely observe what is public. Logged-in or intrusive work and any change to a system need written permission from the owner.

What does it cost the institution?

Nothing. Accepted Public Infrastructure Security work costs $0 and needs no commercial contract.

Who can refer a service?

Anyone who knows of an essential public service at risk. We contact the institution that runs it before any further work.

Is ongoing monitoring included?

Yes. We monitor the service for the full free program period. We agree access, reporting, contacts and triage hours with the owner before it starts.

Programs and pricing

Programs

How every program works

Every program runs the same loop.

Paid or free, the work follows four steps. The free audit covers the first one and shows you where to begin.

Test.
We show how an attacker or AI agent could reach what matters most.
Fix.
We help your engineers close each gap, most urgent first.
Retest.
We test again, so you know each fix works.
Monitor.
We keep watching what changes for the whole term.

Comparison

All seven programs, side by side.

Prices are in US dollars. 'From' is a starting price. We agree the final scope and fee with you before any work begins.

Price, scope and monitoring for each program
Price and term.
Prices in US dollars	Technical Audit Details	Startup Security Details	Business Security Details	Enterprise Security Details	Technical Due Diligence Details	Nonprofit Defence Details	Public Infrastructure Security Details
Price	Free	From$5,000/ year	From$8,000/ year	From$25,000/ year	From$5,000/ engagement	Free	Free
Billed	No charge	Once a year	Once a year	Once a year	Per engagement	No charge	No charge
Term	One review	12 months	12 months	12 months	One engagement	A free period	A free period
What we test.
Systems in scope	One application or one cloud environment	One application with its API and one cloud environment	Up to two applications with their APIs and one cloud environment	One business unit: up to three applications and two cloud environments	One target company: its main product and one cloud environment	One critical digital service	One public digital service
Security reviews	One first review	One baseline review	Two reviews	Four reviews	One deal review	One review	Safe observation of what is public
Tested again after fixes	Not included	One retest	After each review	After each review	Not included	One follow-up review	Fixes checked with the owner
Working with you.
Time with our team	One walkthrough	Four advisory sessions	Four advisory sessions	Quarterly risk reviews	One walkthrough with your deal team	Follow-up on your fixes	Help coordinating fixes
Risk register kept up to date	Not included	Not included	Included	Included	Not included	Not included	Not included
Incident response exercise	Not included	Not included	Not included	One a year	Not included	Not included	Not included
Monitoring.
Ongoing monitoring	Not included	Included	Included	Included	Included	Included	Included
Runs for	Not included	The 12-month term	The 12-month term	The 12-month term	The engagement window	The free period	The free period
What you take away.
Main report	A short risk summary and a fix list in priority order	A security summary for customers and investors	A controls and evidence summary	A leadership evidence pack	A decision memo for your deal team	A private findings summary	A private exposure report

Questions before you choose.

Which program should we start with?

If you're unsure, start with the free Technical Audit. It shows where you stand and which program fits next.

What does 'From' mean?

It's the starting price for the standard scope. We agree the final scope and fee with you before any work begins.

Are the free programs really free?

Yes. Technical Audit, Nonprofit Defence and Public Infrastructure Security cost nothing. The last two depend on eligibility and our capacity.

Is monitoring included?

Yes, in every program except the Technical Audit. It runs for the 12-month term, the engagement window or the free period.

Who makes the fixes?

Your engineers, with our help. We set the order, explain each fix and test again to prove it worked. Hands-on fixing can be scoped separately.

Will you test anything we haven't approved?

No. We only test what you approve in writing, using methods we agree first.

Do you certify our security?

No. We don't certify. We give you findings and evidence that a customer, auditor or regulator can use.

Which currency are prices in?

All prices are in US dollars.

Technical Audit · Free

Start with a free look at one system.

We review one application or cloud environment and show you what to fix first. Then you decide what happens next.

Request a free technical audit How the audit works

Choose how weprotect you.

All programs

Technical Audit

Startup Security

Business Security

Enterprise Security

Technical Due Diligence

Nonprofit Defence

Public Infrastructure Security

Test.

Fix.

Retest.

Monitor.

Questions before you choose.

Start with a free look at one system.