Security and compliance
Find the weak spots before someone else does.
We test your software, cloud and access the way an attacker would, fix what we find, and help you show auditors, regulators and customers that it stays fixed. For systems we built, and for the ones we didn't.
What we check
Where attackers actually get in.
Applications and APIs
Web apps, mobile apps and APIs tested for the usual ways in: broken access rules, injection, weak sign-in and data exposed to the wrong user.
Cloud and servers
Open ports, public storage, missing encryption and unpatched software across your cloud, servers and databases.
Access and accounts
Who can reach what: admin accounts, shared passwords, two-step sign-in, and staff who left but can still log in.
Code and libraries
Passwords and keys left in code, libraries with known flaws, and how a change reaches production.
AI features
Chatbots and assistants checked for prompt injection and for showing data they should keep to themselves.
Backups and recovery
Whether backups exist, sit apart from production and can actually be restored after an attack.
Who asks us
Usually there's a deadline, an audit or a scare.
Banks and microfinance institutions
Technical gaps and evidence for the National Bank of Cambodia's technology and cyber risk guidelines, or the yearly test your board expects.
SaaS companies selling abroad
Security questionnaires from larger customers, and the groundwork for ISO 27001 or SOC 2.
Companies running inherited software
A system a vendor built and left behind, that nobody has checked since.
After an incident
A breach, a defaced website or a ransom note. We help contain it, find how it happened and close the gap.
The security review
Two weeks. US$3,000. A ranked list of what to fix.
A fixed-price review of one system: its application, cloud and access. You know where you stand before you commit to anything larger.
- 01We agree scope, test dates and contacts in writing, and sign an NDA.
- 02We test the application, cloud set-up and access, keeping your team informed throughout.
- 03You get every finding ranked by real risk, with the fix, the effort and a fixed quote to close them.
- Fixes and hardening
- Quoted from the review
- Audit readiness
- US$10,000–30,000
- Ongoing security
- US$800–3,000 a month
How we test
Tested with permission. Reported in plain language.
Permission in writing
Scope, test windows and emergency contacts are agreed before any test. Nothing is tested by surprise.
Ranked, not dumped
Each finding is rated by what it could cost your business, with the fix and the effort. Not a scanner export.
Retest included
We check every fix ourselves, and the report shows what was closed and what is left.
Independent when required
If a regulator or customer needs a certified third-party tester, we say so up front and work alongside them.
Questions we hear
Two weeks to know where you stand.
A fixed-price review of one system: what's exposed, what to fix first and what it costs to close.