A scoped review of a website, application or server.
Written findings you can act on and share with counsel, insurers or a counterparty.
Coverage, method and priority — written down.
An assessment is a time-boxed review of systems you authorize. It sits under Audits. We combine automated checks with analyst review, then write up what is confirmed, what is suspected, and what we did not test.
It is not a promise that every weakness has been found. It is a defensible statement of coverage: the document most clients need for an insurer, a client questionnaire or an internal decision.
The same standard applies internationally. Remote review is the default. Headquartered in Canada, with work across North and South America, and as far as Ireland, Singapore and the Cayman Islands.
Websites
Public sites, portals and content systems: exposure, configuration, authentication and common application flaws visible from the internet.
Applications
Web applications and APIs you operate: session handling, access control and the paths that hold customer or operational data.
Servers
Hosts and supporting infrastructure you designate: services, patch posture, remote access and configuration that should not be public.
A report, a priority order, a call.
- Written report. Findings, evidence, severity and recommended next steps.
- Priority order. What to fix this week versus what can wait.
- Review call. With the people who will do the work and the people who approve it.
- Scope statement. What was in, what was out, and any limits.
The limits stay in the report.
- Test systems you do not authorize, including third-party SaaS you do not control.
- Run destructive tests on production without a separate written approval.
- Claim a framework certification as an outcome of the assessment.
- Use your findings or name in marketing.
Request a written proposal.
Describe the system, vendor or AI deployment under consideration. We respond with the proposed scope, timeline and fee.