Is this a penetration test?

No. Pentests are active probes against running infrastructure. Our audit is a read-only review of configuration, patch level, credentials and policy. Most stores need this first; pentests are valuable on top of it but not before.

Will the audit affect production?

No. Everything we do is read-only. We do not deploy anything, we do not run active probes, and our external checks hit the store at the same rate a normal browser would.

What if you find an active exploit?

We escalate the same day. Severity-1 findings get a dedicated email summary inside business hours of discovery, and we recommend an immediate mitigation while the full report is being written.

Yes, before any access is shared. Standard mutual NDA or yours; same-day signature on standard terms.

Can you remediate the findings?

Yes. 100% of the audit fee credits against any remediation engagement inside 60 days. About half of customers do the remediation in-house once they have the prioritised list.

Website Audits

Website Security Audit

Website security audit. Configuration review, vulnerability scan, third-party integration check, prioritised remediation.

Turnaround: 5 working days
Mode: Read-only
Walkthrough: 60 minutes
Scoring: Severity + exploitability

Overview

What it is.

Security audit for ecommerce stores. We review configuration, scan for known vulnerabilities, audit third-party integration credentials, and check for the common patterns that lead to breaches. Read-only on production. Output is a prioritised remediation list with severity, exploitability and effort scored. Most audits run 5 working days. Stores with active incidents or known prior breaches get a focused investigation as a separate engagement.

What you get

Deliverables.

Configuration review (admin URL, 2FA, session config, file permissions)
Patch-gap analysis (CVEs vs current install)
Third-party integration credential audit
Content Security Policy review
Outbound traffic and webhook audit
Admin user role and access review
Prioritised remediation list (severity + exploitability + effort)
60-minute walkthrough call

Honest limits

What it isn't.

Not a penetration test; pentests are a separate engagement
Active incident response is a separate engagement
Custom-application vulnerability fuzzing is out of scope

Not sure if it's a fit? Email us. We'll tell you straight.

How it works

From inquiry to handover.

01
1. Brief
Read-only access provided. NDA in place. Scope of integrations confirmed.
02
2. Audit
Configuration, CVE-gap, credentials and policy review. Findings catalogued with severity.
03
3. Report + walkthrough
Written report and 60-minute walkthrough with the engineer who ran the audit.

Frequently asked

Questions we get from people about to book.

Is this a penetration test?: No. Pentests are active probes against running infrastructure. Our audit is a read-only review of configuration, patch level, credentials and policy. Most stores need this first; pentests are valuable on top of it but not before.
Will the audit affect production?: No. Everything we do is read-only. We do not deploy anything, we do not run active probes, and our external checks hit the store at the same rate a normal browser would.
What if you find an active exploit?: We escalate the same day. Severity-1 findings get a dedicated email summary inside business hours of discovery, and we recommend an immediate mitigation while the full report is being written.
Do you sign NDAs?: Yes, before any access is shared. Standard mutual NDA or yours; same-day signature on standard terms.
Can you remediate the findings?: Yes. 100% of the audit fee credits against any remediation engagement inside 60 days. About half of customers do the remediation in-house once they have the prioritised list.

Ready to start?

Tell us about your project.

A member of our team reads every message. Replies within one business day. No sales call required.

See all services

Website Audits

Website Security Audit

Website security audit. Configuration review, vulnerability scan, third-party integration check, prioritised remediation.

Turnaround: 5 working days
Mode: Read-only
Walkthrough: 60 minutes
Scoring: Severity + exploitability

Overview

What it is.

What you get

Deliverables.

Configuration review (admin URL, 2FA, session config, file permissions)
Patch-gap analysis (CVEs vs current install)
Third-party integration credential audit
Content Security Policy review
Outbound traffic and webhook audit
Admin user role and access review
Prioritised remediation list (severity + exploitability + effort)
60-minute walkthrough call

Honest limits

What it isn't.

Not a penetration test; pentests are a separate engagement
Active incident response is a separate engagement
Custom-application vulnerability fuzzing is out of scope

Not sure if it's a fit? Email us. We'll tell you straight.

How it works

From inquiry to handover.

01
1. Brief
Read-only access provided. NDA in place. Scope of integrations confirmed.
02
2. Audit
Configuration, CVE-gap, credentials and policy review. Findings catalogued with severity.
03
3. Report + walkthrough
Written report and 60-minute walkthrough with the engineer who ran the audit.

Frequently asked

Questions we get from people about to book.

Is this a penetration test?: No. Pentests are active probes against running infrastructure. Our audit is a read-only review of configuration, patch level, credentials and policy. Most stores need this first; pentests are valuable on top of it but not before.
Will the audit affect production?: No. Everything we do is read-only. We do not deploy anything, we do not run active probes, and our external checks hit the store at the same rate a normal browser would.
What if you find an active exploit?: We escalate the same day. Severity-1 findings get a dedicated email summary inside business hours of discovery, and we recommend an immediate mitigation while the full report is being written.
Do you sign NDAs?: Yes, before any access is shared. Standard mutual NDA or yours; same-day signature on standard terms.
Can you remediate the findings?: Yes. 100% of the audit fee credits against any remediation engagement inside 60 days. About half of customers do the remediation in-house once they have the prioritised list.

Ready to start?

Tell us about your project.

A member of our team reads every message. Replies within one business day. No sales call required.

See all services

Website Security Audit

What it is.

Deliverables.

What it isn't.

From inquiry to handover.

1. Brief

2. Audit

3. Report + walkthrough

Questions we get from people about to book.

Tell us about your project.

Website Security Audit

What it is.

Deliverables.

What it isn't.

From inquiry to handover.

1. Brief

2. Audit

3. Report + walkthrough

Questions we get from people about to book.

Tell us about your project.