We test the systems that matter, help you fix them and map the results to the controls your customers and regulators ask about. Monitoring runs for 12 months.
- Access reviewsReview 1Test notesRetested
- Payment data flowsReview 1Data-flow mapFixing
- Admin accountsReview 1Account listRetested
- Backups and restoreReview 2Restore testPlanned
- Change approvalsReview 2Not yetOpen
- Price · USD
From$8,000USD / year
Starting price. We agree the final fee before work begins.
- Term
12 months
Billed once a year
- Monitoring
Included
For the full 12-month term
- Best for
Mid-sized and financial businesses
Annual security program
Your year
A year of testing, fixing and proof.
Twelve months, with two reviews, two retests and four advisory sessions. Monitoring runs for the whole term.
- 2
- Focused security reviews, each followed by a retest
- 4
- Advisory sessions across the year
- 12
- Months of monitoring, with alerts sent to your contacts
- 1
- Risk register we keep up to date with you
What you get
- Findings and retest evidence for each review
- A risk register with an owner for every item
- A controls and evidence summary for customer or regulator questions
- Quarterly notes and a fix plan in priority order
- Monitoring findings, alerts we raised and next actions for the full term
Risk register
Every finding has an owner and a status.
Your engineers and your risk team work from one list. Try the filters on this example.
| Severity | Finding | Owner | Status |
|---|---|---|---|
| Critical | Payment API trusts totals sent by the browser | Payments | Fixing |
| High | Support staff can see full card numbers | Operations | Retest |
| High | One shared admin login for the cloud console | IT | Open |
| Medium | Backups have never been restored in a test | Infrastructure | Fixing |
| Medium | Old supplier account still active | IT | Closed |
| Low | Error pages show software versions | Web | Closed |
Monitoring for the term
Alerts reach the right owner.
We watch your applications, APIs and cloud for the full 12 months.
When something needs action, we alert your technical owner, your risk owner or both, and log it in the register.
- Day 41New admin login from an unusual countryTechnical owner
- Day 88Payment library has a known security flawRisk register
- Day 133Nightly backup failed twice in a rowTechnical ownerRisk owner
- Day 212A storage bucket was made publicTechnical owner
Who it's for
For businesses that answer to customers and regulators.
For mid-sized and financial businesses with a clear set of systems. Larger groups with several companies usually need Enterprise Security.
Mid-sized businesses
You have a few key systems, a growing team and customers who ask hard questions.
Fintech and financial-services teams
Payments, lending or customer money. We map our evidence to the controls you answer to.
Companies facing customer, partner or regulator reviews
A customer audit, a partner review or a regulator's visit is coming. You need proof, not promises.
Scope
What's included, what we need and where we stop.
We only test what you approve in writing. Anything beyond this scope is quoted separately.
What's included
- Up to two applications with their APIs, plus one cloud environment
- Two focused security reviews during the 12-month term
- Access, sensitive data flows, dependencies and backups
- A retest after each review
- Four advisory sessions and a risk register we keep up to date
- Mapping of test evidence to the controls your customers or financial regulators ask about
- Ongoing monitoring of your systems for the full term, with alerts sorted and sent to your contacts
What we need from you
- The applications, their APIs and the cloud environment in scope
- A technical owner and a risk or compliance contact
- The controls you must meet and the evidence you already have
- Written permission to test and change windows we agree
- Monitoring access or data feeds, alert contacts and who to call when something is urgent
Where we stop
- The starting price covers the systems in scope. We quote extra entities, products, countries or cloud environments separately.
- Evidence mapping supports your review. It is not regulatory approval or a certification.
- A 24-hour security operations centre, incident response and hands-on fixing are scoped separately.
- Monitoring covers the systems and signals we agree, for the 12-month term. We write down methods, triage hours and escalation times before it starts. Monitoring does not guarantee that an incident will be contained.
Questions from finance and risk teams.
Can a bank or fintech use Business Security?
Yes, if the work fits the starting scope. Groups with several entities usually need Enterprise Security.
Will you make every fix?
We set the order, help your team and test again to prove each fix. Hands-on fixing is quoted separately.
Is this regulatory approval?
No. We map our test evidence to the controls you name. Your regulator or auditor makes the decision.
Which controls can you map our evidence to?
The ones your customers or financial regulators ask about. Tell us the controls you must meet and the evidence you already have.
Is ongoing monitoring included?
Yes. We monitor the systems in scope for the full 12-month term. We agree access, reporting, contacts and triage hours before it starts.
Business Security
Give customers proof they can check.
Tell us which systems matter, which controls you must meet and your deadline. We agree the scope and fee with you.