Security
Cybersecurity & penetration testing
Overview
Vulnerability assessment, pen testing, security audits, OWASP compliance, and hardening reports.
Delivery
Cybersecurity & penetration testing Delivery Process
Discover
We map your business, your users, and what winning looks like before a single pixel.
Design
Direction, identity, and interfaces: shared early and reviewed with you at every step.
Build
Engineering in weekly slices you can see, click, and comment on as they land.
Launch
QA, performance, SEO, and deployment handled end to end. Nothing left to chance.
Grow
Support, iteration, and new capabilities as your business scales beyond launch day.
Details
Typical timeline
Per audit
Best for
Deliverables & Scope
- → Vulnerability scan and manual testing against the OWASP Top 10
- → Written report listing each finding with severity and reproduction steps
- → Remediation guidance your developers can act on directly
- → Re-test of fixed issues to confirm they are actually closed
- → Executive summary page suitable for management or a client audit
Post-Delivery
- → 30-Day Bug Warranty
- → Source Files & Ownership
- → Handover Training Session
Investment
Cybersecurity & penetration testing Investment & Pricing
Indicative starting ranges - every project is quoted to its real scope.
FAQ
Cybersecurity & penetration testing FAQs
How much does penetration testing cost?
US clients pay $1,000 to $6,000 and Australian clients pay A$1,500 to A$8,500 per audit. A single web application with a handful of user roles sits at the low end. Multiple applications, APIs, and internal network testing sit at the top.
How long does a test take?
One to three weeks including the report. The testing window itself is usually three to eight days. Writing findings up clearly takes real time, and a rushed report is worth very little to your developers.
Who owns the report and the findings?
You do, and it is confidential. We do not publish findings, name clients, or reuse your data. If you need it for a compliance audit or a client security questionnaire, you can share it under your own NDA.
What happens after the report?
You get a re-test window, typically 30 days, to confirm fixes worked. We can also do the remediation work ourselves, though that means the same team fixing and re-testing, which is a weaker check than a fresh pair of eyes.
Will testing break our live site?
We test against a staging copy by default. Live testing carries real risk: automated scanners can submit forms, create junk records, or trip rate limiting and lock out accounts. If only production is available we agree on the boundaries in writing first.
Is a clean report a guarantee we are secure?
No. A test covers the scope and time window agreed, and it reflects what a competent tester found in that period. New code ships new bugs, so an annual test on a fast-moving application leaves a lot of the year uncovered.
Do you provide certification we can show customers?
We provide a testing report and a letter confirming the scope and dates. That is not the same as an ISO 27001 or SOC 2 certification, which are organisational audits and a separate process entirely.
Ready to start your project?
Start this project