Essential Care
From €149 / month
- Monthly external vulnerability scan (agreed scope)
- Simple “traffic light” risk summary
- Email support for clarification
Ideal for: Small websites and early-stage businesses.
Penetration Testing That Finds What Attackers Can Actually Exploit
Clear priorities, real proof, and practical fixes — built for small & mid-size businesses.
Most small businesses don’t get “targeted”. They get hit by automated scanning, reused exploits, weak credentials, and simple misconfigurations. My job is to show you what’s exposed, what matters most, and what to fix first — without burying you in jargon.
Fastest way to start
If you’re unsure what you need, start with a quick check. You’ll get a clear direction in minutes — not weeks.
Run the Free Scanner Book a 15-min Scope Call
No long contracts. No “mystery” deliverables. You’ll know exactly what you’re getting before anything starts.
Not sure where to start?
Pick what sounds closest to your situation. I’ll recommend the best starting point and what you’ll get.
What you get (every time)
- Evidence: clear proof-of-issue with impact explained
- Priorities: a short “fix first” list (not a long wish-list)
- Reports: executive-friendly summary + technical detail where needed
- Optional retest: verify fixes actually worked (not “trust me bro”)
Core Services
Choose a focused test when you have a specific target, or use a care plan if you want ongoing visibility. Most SMBs get the best value by starting focused, then moving into a monthly plan.
Web Application Pentest
For websites, client portals, dashboards, and web apps. This is where most real-world breaches begin.
- Authentication & session weaknesses
- Access control failures between roles/tenants
- Injection, input validation, and data exposure
- File upload and unsafe endpoints
- Business logic abuse scanners miss
Outcome: a prioritized fix list + evidence so your devs can act immediately.
Typical range: €350 – €900 (small sites), €900 – €1,800 (larger/complex).
API Security Assessment
APIs power mobile apps, integrations, and partner access — and they’re often wide open without anyone noticing.
- Broken object/function authorization
- Token handling, auth flows, and identity gaps
- Data leakage and overly permissive responses
- Rate limiting, brute force, and enumeration risks
Outcome: blocked abuse paths + clear remediation steps by endpoint area.
Typical range: €450 – €1,200 depending on endpoints and auth complexity.
Network & Infrastructure Testing
For external exposure, server misconfigurations, remote access, and internal lateral movement risks.
- Host/service discovery in agreed ranges
- Weak/default credentials and misconfigurations
- Unnecessary exposure of admin/management interfaces
- Attack paths after first foothold
Outcome: reduce blast radius and remove easy entry points.
Typical range: €500 – €1,500 depending on hosts and internal vs external scope.
Social Engineering & Awareness Testing
Security isn’t just technical. A single click or reused password can undo everything else. These tests are always authorized, controlled, and designed to improve, not embarrass.
- Phishing simulations with safe landing pages
- Metrics to identify training gaps
- Actionable recommendations without blame
Typical range: €250 – €750 (phishing), €750 – €1,400 (multi-step scenarios).
Scenario-Based / Red Team-Style Engagements
For businesses that want impact demonstrated realistically: objectives, attack paths, and true business risk.
- Objective-driven testing (not checkbox testing)
- Chained weaknesses to show real impact
- Optional detection/response validation
Typical range: €1,200 – €3,500 depending on objectives and scope.
Reporting, Debriefs & Fix Verification
Testing is pointless if it doesn’t translate into action. You get a clear roadmap and support to execute it.
- Prioritized findings (business + technical view)
- Walkthrough of critical issues & attack paths
- Optional re-test to confirm fixes
Included with every engagement. Retesting typically €150 – €450 depending on scope.
Ongoing Security Care Plans
One-off pentests are a strong start. But exposure changes weekly: plugins update, staff change, new systems get added. Care plans give you ongoing visibility and a simple, repeatable way to stay ahead — without hiring a full security team.
Most businesses should start with Growth Care
It’s the best balance of regular scanning, deeper review, and fix prioritization — without enterprise overhead.
Growth Care
From €249 / month
- Monthly external scan + quarterly deeper review
- Short call or recorded walkthrough
- Re-testing of high-risk fixes
- Clear “fix first” guidance based on risk
Ideal for: Growing teams with more than one public-facing system.
Full Security Partner
From €449 / month
- Tailored scan frequency (based on your environment)
- Priority scheduling for pentests and retests
- Advisory support when something feels off
- Support for insurers / compliance questions
Ideal for: Businesses that want a long-term technical security partner.
All pricing depends on scope and complexity. These ranges are a starting point — you’ll receive a tailored proposal before you commit to anything.
How It Works
1) Define scope (no surprises)
We agree targets, rules, time window, and what “done” looks like. No testing outside written authorization.
2) Test & validate
I validate issues with real evidence — not just scanner output — and focus on what’s actually exploitable.
3) Report & prioritize
You get a clear “fix first” roadmap: what matters now, what matters later, and how to reduce risk quickly.
4) Optional re-test
After fixes, I verify critical items are actually closed. This is where many tests fail — I don’t skip it.
Risk reduction, not fear marketing
- No long-term contracts (care plans can be cancelled)
- No changes made to your systems without approval
- Testing only on systems you own or authorize
- Clear deliverables before the engagement begins
Security in Numbers
The internet is constantly scanned. Attackers don’t need to “hate” your business — they only need one exposed service, one weak login, or one unpatched component.
Constant probing
Internet-facing systems are scanned continuously by automated bots and commodity tools.
Human error is common
Weak passwords, reused credentials, and phishing are still the easiest entry points.
Attackers reuse old bugs
Public vulnerabilities are weaponized fast — unpatched systems stay valuable targets.
Pentesting changes the odds
You shift from guessing and reacting to fixing the highest-risk issues first.
Ready for a clear starting point?
If you’re unsure what you need, run the free scan. If you already know what you want tested, book a short scope call.
FAQ
Will this break my website?
No. Testing is controlled and scoped. I avoid disruptive actions unless explicitly approved.
Do you need credentials?
Sometimes. Black-box testing checks what attackers see; authenticated testing finds deeper issues. We decide based on goals.
How long does it take?
Depends on scope. Small web tests can be quick; larger systems take longer. You’ll get a timeline before we start.
Can you re-test fixes?
Yes. Retesting is available and recommended for critical findings, especially if you need proof for stakeholders.