Find the holes before someone else does.
We test your website, your email, and the systems you have online, by hand and with tools, and only what you approve in writing. You get every problem in plain English, worst first. We can fix it, then retest to prove it's gone.
Co-founded by a U.S. Army veteran. Based in York, Pennsylvania.
We find it, explain it, fix it, and prove it's fixed.
Tested by people, with tools
Scanners catch the known problems. A person catches the rest, like a login that shows one customer another customer's records.
Plain English, worst first
Every finding says what it means, why it matters, and how to fix it, sorted so you know what to do first.
We can fix it
Want it handled? We make the fixes ourselves. Or hand the report to your IT person, since every finding comes with the steps.
Proof it's gone
After a fix, we test again. Your report shows which retest confirmed it, so "fixed" means fixed.
A report you can act on
An overall risk rating and why, what to fix first, then every finding with its evidence and fix steps. Ready to print or save as a PDF.
Only what you approve
Nothing gets tested until you sign off, in writing, on exactly what we may touch and when. Every step we take is logged.
The places attackers look first.
- Your website and its login pages. Missing protections, weak sign-in, and pages that show more than they should.
- Your email setup. Whether someone could send email that looks like it came from you.
- Servers and services you have online. What answers from the internet, and whether it should.
- Software with known flaws. Outdated versions, with the ones attackers are using right now flagged first, based on the U.S. government's public list (CISA).
- Keys and passwords left in code. If you have code, we check it and its history.
- Customer portals and apps. Hands-on testing of who can see what, in a full assessment.
From a free look to proof it's fixed.
A free exposure check
We look up the public records about your domain and send you a short write-up within 2 business days. We never touch your systems for it.
You sign off on the scope
On a short call we agree what to test and when, and you approve it in writing. Anything not on that list stays off limits. Tests that could slow a system down need a second tester's sign-off and run in a window you pick.
We test, report, fix, and retest
You get the report, worst problems first. We fix what you want us to fix, then retest so the report shows each fix confirmed.
Start free. Keep watch for a flat monthly.
The exposure check is free. One-time assessments are priced on a call, because every business has different things online. Ongoing monitoring is a flat monthly.
- Your email security settings
- Web addresses publicly listed for your domain
- Your domain's certificate and archive history
- A short write-up, worst first, with how to fix each
- Within 2 business days
- Weekly scans of your website and the systems you have online
- An alert when a flaw attackers are using shows up
- A monthly report in plain English
- A retest after every fix
- 1 hour of fixes a month included
- Replies during business hours
- Security Check-up: your website, email, and systems online, tested by hand and with tools
- Full Assessment: adds customer portals and apps, your office network, and your code
- A report with every finding, worst first
- A retest to prove the fixes worked
- Fixes quoted in your report
Sign up for 12 months of Security Watch and your Security Check-up is included.
Start with a full test of your website, email, and systems online, then we keep watching every week after. One price, from day one.
Already on our website care plan? Add Security Watch for +$99/mo.
We already host and update your site, so the add-on covers weekly security scans of it, alerts when a flaw attackers are using shows up, and a monthly report.
See the care planJohn and Brody, testing and fixes.
The people who test your systems are the people you talk to, from the first call to the retest.
What we are, and what we're not.
- We never test anything you haven't approved in writing. Not a subdomain, not a server, not a login.
- We're not a 24/7 monitoring or emergency response service. We reply during business hours.
- We don't certify compliance such as HIPAA or SOC 2. Our report can help you prepare for one.
- We don't promise you can't be hacked. Nobody honestly can. We find what's there, fix it, and prove the fix.
The stuff we get asked most.
Will testing break anything?
We agree in writing what we test and when, and start with the gentlest checks. Anything that could slow a system down needs a second tester's sign-off and runs in a window you pick.
Do you fix the problems, or just report them?
Either. We can make the fixes and retest them, or you can hand the report to your IT person. Every finding includes the steps to fix it.
What do I get at the end?
A report with your overall risk and why, what to fix first, then every finding: what it means, why it matters, the evidence, and how to fix it. After fixes, the retest results show what's gone.
Do I need to be technical?
No. Everything is written in plain English, and we walk you through it on a call.
Who sees what you find?
Only you and the people you name. Here's how we handle your test results.
Tell us what you want checked.
We get back to you to set up a short call.
A short call to scope it. What you have online, and what you want tested.
You approve the scope in writing. Then we test, report, fix, and retest.