Security audit
We review your code, access, infrastructure and processes from the inside, then show you where you are exposed and give recommendations on what to fix first.
What we deliver
- Source code review for security flaws
- Third-party libraries and dependencies
- Access rights, roles and stored secrets
- Cloud, server and network configuration
- Backups, logging and incident readiness
- Handling of personal and payment data
How it fits together
- 01Scopesystems, goals, standards
- 02NDA and accessread-only where we can
- 03Reviewcode, access, cloud, processes
- 04Findingsranked by risk
- 05Walkthroughwith your team
- 06Recommendationswhat to fix first
Standards and tools
- OWASP ASVS
- OWASP Top 10
- CIS Benchmarks
- ISO 27001
- SOC 2
- Semgrep
Questions
Ask us anythingWhat is the difference between an audit and a penetration test?
A penetration test attacks your product from the outside. An audit looks at how it is built and run from the inside: code, access, cloud and processes. They find different things, and many companies do both.
Which should we do first?
If you have never had a security review, start with the audit. It closes the broad gaps first. A penetration test then shows what can still be reached.
What access do you need?
Read-only access to your code and cloud, plus a short talk with the people who run them. We sign an NDA first and stay away from production data wherever we can.
Will this get us certified?
No, we are not a certification body. We can show where you stand against ISO 27001 or SOC 2 and what is missing, so you go to the certifying auditor prepared.
Can you fix what you find?
Yes. We build software every day, so your team can take the recommendations or we can do the fixes as separate work.
How much does it cost?
It depends on the size of the code and infrastructure. We agree the scope and a fixed price after a free call.