Productised. Fixed-price. Written down.

Security Health Check

$1,995

A fast, external read of your application's security posture. Not a pen test — a triage. You'll know whether you need one, and where to spend if you do.

What's included

• External unauthenticated scan (TLS, headers, exposed endpoints, common misconfigs)
• OWASP Top 10 light sweep against a single web app
• Dependency vulnerability scan
• One-page written report with prioritised findings
• 30-minute debrief call

What's not

• Authenticated testing, manual exploitation, business-logic flaws, source code review — those need Tier 2 or above.

Web App Pen Test

$5,995

A focused penetration test of a single small web app. Manual testing on top of automation, written for a developer to act on Monday morning.

What's included

• Authenticated and unauthenticated testing
• OWASP Top 10 coverage (injection, broken auth, sensitive data, access control, misconfig, XSS, deserialisation, vulnerable deps, logging)
• Manual business-logic testing
• Written report with reproducible PoCs, severity ratings, fix proposals
• 1-hour debrief
• Free retest after remediation (one round, within 90 days)

Full Pen Test

$11,995

Standard pen test for a growing SaaS — web application plus API. Manual exploitation, attack-chain analysis, the works. The kind of report your enterprise customers will ask to see.

What's included

• Everything in Tier 2
• API testing (REST, GraphQL, WebSocket)
• Multi-role privilege escalation, IDOR, broken access control
• Authentication and session deep-dive (JWT, OAuth, passkeys, MFA, password reset)
• Third-party integration review (webhooks, OAuth providers, payment processors)
• Attack-chain documentation (how findings combine end-to-end)
• Working PoCs (code, not screenshots)
• Written report, 1.5-hour debrief, free retest within 90 days

Pen Test + Remediation

$24,995

The differentiator. Most pen test firms hand you a PDF and bill again for follow-up. We find the issues, then fix them.

What's included

• Everything in Tier 3
• Hands-on remediation of findings in your codebase (up to 15 findings; criticals beyond that re-quoted)
• Pair-programming session with your engineers so the fix sticks and the team learns the pattern
• Verification retest after fixes are merged
• 30-day post-engagement support (questions, regression checks)

What's not

• Major architectural rewrites — re-quoted as a separate project.
• Production deploys. We open PRs against your repo; your team merges and ships.

Code Security Review

$6,995

Different from a pen test. We read the codebase the way an attacker would — auth flows, session handling, input validation, secrets handling, dependencies, infra config. Catches things black-box testing misses.

What's included

• Full source code read of the application repo
• Auth, session, RBAC, secret handling, input validation
• Dependency audit (CVEs, abandoned packages, licence issues)
• Infrastructure-as-code review if present (Terraform, Docker, Kubernetes)
• Written report with file:line references and fix proposals
• 1-hour debrief with engineering team

NZ Privacy Act Review

$3,995

How you collect, store, share, and dispose of personal information — measured against the 13 Information Privacy Principles of the Privacy Act 2020. Practical and OPC-credible, not a 90-page theatre piece.

What's included

• 13 IPPs mapped to your actual system and data flows
• Data flow diagram (what's collected, where it lives, who it's shared with, how long it's kept)
• Vendor and sub-processor audit (offshore data transfers, US-based SaaS, analytics SDKs)
• Privacy notice / policy review (or draft, if you don't have one)
• Breach-readiness check against OPC notification requirements
• 1-hour debrief

AI Safety Review

$4,995

An honest read of how you're using LLMs. Where the risks are, what to monitor, what to change. Practical, not academic.

What's included

• Prompt design review (injection surface, data exposure, jailbreak resistance)
• Data flow into and out of LLM providers (what's leaving your perimeter)
• Hallucination and failure-mode handling (where the model is allowed to be wrong, where it isn't)
• Evaluation and regression coverage
• Cost, rate-limit, and observability controls
• 1-hour debrief

AI Risk & Governance Review

$5,995

Different from the AI Safety Review. That one is for engineers. This one is for the board, the audit committee, legal counsel, and the CISO. The question it answers: can we sign off on how this organisation uses AI?

What's included

• AI use inventory — what AI tools are being used, by which teams, for what tasks, with what data
• Vendor due diligence — data residency, training-data use, contractual protections, sub-processors, model change-control
• Regulatory exposure — Privacy Act 2020, OPC AI guidance, EU AI Act if relevant, copyright and IP risks
• Policy review or drafting — acceptable use, employee guidance, customer-facing disclosure
• Liability and insurance — what your PI / cyber cover does and doesn't say about AI
• Board memo — a signable assurance document for the audit committee or risk register

Pre-launch Security Check

$2,995

For startups about to go live. Catches the obvious things before your first real users hit it. Not a substitute for a pen test once you have traction — a baseline so you're not embarrassing yourself on day one.

What's included

• External scan plus OWASP Top 10 sweep
• Auth flow review (signup, login, password reset, session)
• Secrets / credential hygiene check
• Dependency audit
• Hosting and DNS configuration check (TLS, headers, CSP)
• 30-minute debrief with founders

M&A Security Due Diligence

$9,995

For acquirers. We read what you're about to buy. Independent, fast, written for non-technical decision-makers as well as the engineering team that'll inherit the code.

What's included

• Codebase security audit (focused on red flags, not exhaustive)
• Infrastructure and hosting review
• Privacy posture (Privacy Act 2020, GDPR exposure)
• Dependency, licence, and IP risk audit
• Secrets-in-repo check (git history)
• Outstanding-disclosure check (HaveIBeenPwned, public incident history)
• Written report with risk-rated findings and remediation cost estimates
• 1-hour debrief with the deal team

Security Retainer

$2,495 / month

For teams that don't have a CISO but need security thinking baked into how they ship. A security partner on call, plus an annual pen test included.

What's included

• Monthly 1-hour review of what shipped and what's coming
• One pen test per year included (Tier 2 or 3, your choice)
• Slack / email access for ad-hoc questions (24-hour response on business days)
• Code review on new auth-touching or PII-touching features (up to 3 PRs/month)
• Quarterly dependency and posture review
• Incident response standby — first responder if something goes wrong (incident work billed at $250/hr above the retainer)