Find the weak spots before someone else does.
Authorised testing of your networks, web apps and cloud accounts, plus the policies, training and part-time security leadership to fix what we find. Fixed prices in PKR.
- Written authorisation before any test
- No hacking-for-hire, ever
$ preflight --engagement example [ok] written authorisation signed by system owner [ok] targets listed: 2 hostnames, 8 public IPs [ok] hosting provider terms allow testing [ok] window: Tue 22:00 – Wed 04:00 PKT [ok] emergency contact reachable [--] anything not listed ....... OUT OF SCOPE [--] denial-of-service ......... NEVER → testing may begin inside the window
Four rules we never bend
- 01
Written authorisation
The owner of every system signs our authorisation and scope before any testing. If you don’t own or control it, we don’t test it.
- 02
Exact scope
Targets, techniques and exclusions are listed. Anything not on the list is out of scope — no “quick look” at something else.
- 03
Agreed window, stop on request
We test only in the agreed window, stop the moment you ask or a system looks unstable, and never run denial-of-service tests.
- 04
Confidential findings
Reports live on your private project page. Testing evidence is encrypted and deleted 90 days after the final report.
What we assess, review and build
Start with the area that worries you most. Every testing service begins with a signed scope; every advisory service begins with a short interview.
Security assessments
Authorised testing of your internet-facing networks and web applications, with clear, ranked findings.
2 services
Cloud & workspace reviews
Configuration reviews of cloud accounts and Microsoft 365 or Google Workspace tenants.
2 services
Policies & ISO readiness
IT security policies, incident response plans and ISO/IEC 27001 readiness gap assessments.
3 services
Awareness training
Live training that helps staff spot phishing, scams and risky habits.
1 service
vCISO & advisory
A part-time security lead, booked in monthly blocks of hours.
1 service
Fixed-price engagements
Prices are for the scope stated on each package. Larger or unusual environments get a written quote with milestones.
External network vulnerability assessment
An authorised check of your internet-facing IP addresses and hostnames for exposed services, weak configurations and known vulnerabilities.
Web application security assessment
Authorised manual and automated testing of your website, web app or API against common attack techniques, with fixes your developers can use.
Cloud security configuration review
A read-only review of your AWS, Azure, Google Cloud or DigitalOcean setup: identity and access, network exposure, storage, logging and encryption.
ISO/IEC 27001 readiness gap assessment
Find out how far you are from ISO/IEC 27001 certification, what’s missing, and the order to fix it in — before you pay for an audit.
vCISO hours
A part-time security lead for your organisation — strategy, customer security questionnaires, vendor reviews and board updates — in monthly blocks of hours.
From scoping call to retest
-
01_scopeScoping call
We agree what is being assessed, why, and who owns it.
-
02_authoriseSigned authorisation
The system owner signs the rules of engagement: targets, window, contacts.
-
03_testTesting window
Non-disruptive testing, only inside the agreed window and scope.
-
04_reportReport
Plain-language summary, ranked findings, evidence and fixes.
-
05_readoutRead-out
We walk your team through every finding and answer questions.
-
06_retestRetest
Within 30 days on most packages, to confirm the fixes work.
We will
- Assess systems you own or control, with the owner’s signed authorisation.
- Verify findings by hand and rank them by real-world risk.
- Explain every finding so your developers and managers can act on it.
- Tell you plainly when something is fine and doesn’t need fixing.
- Delete testing evidence on a fixed schedule.
We won’t
- Test any system you don’t own or control, or without written authorisation.
- Offer hacking-for-hire, “account recovery” or access to anyone else’s email, social media or phone.
- Track, monitor or spy on any person.
- Promise that anything is “hack-proof” — no honest assessment can.
- Claim partnerships or certifications we don’t have. We are not an ISO certification body.
vCISO hours
Senior security judgement without a full-time hire. Prepaid monthly, with a timesheet — never renews automatically.
8 hours a month
- 8 advisory hours a month
- Monthly planning call
- Monthly timesheet
- Email support in business hours
Already have one? Sign in
Prepaid month · never renews automatically
16 hours a month
- 16 advisory hours a month
- Monthly planning call
- Monthly timesheet
- Quarterly management update
- Email support in business hours
Already have one? Sign in
Prepaid month · never renews automatically
32 hours a month
- 32 advisory hours a month
- Fortnightly planning calls
- Monthly timesheet
- Quarterly management update
- Email and call support in business hours
Already have one? Sign in
Prepaid month · never renews automatically
No surprises in the terms
What you get with every engagement, stated plainly.
- price
- Fixed, in PKR, for the scope on the package.
- scope
- Written and signed by the system owner before testing.
- payment
- Larger engagements in milestones — scoping, testing, report — paid one at a time.
- refunds
- Full refund before the testing window, or if authorisation can’t be obtained. Refund Policy
- pay_with
- Raast QR · JazzCash · Easypaisa, approved in your own app.
- support
- Monday–Saturday, 10:00–18:00 PKT · [email protected]
Common questions
Can you test a website or system that isn’t ours?
No. We only test systems you own or control, and the owner must sign our written authorisation first. If your site is hosted or built by a third party, you confirm their terms allow the test — we’ll help you check.
Can you get into someone’s email, social media or phone account?
No. We don’t offer hacking-for-hire, account recovery or access to anyone else’s accounts, devices or messages, for any reason. If your own account has been taken over, use the platform’s official recovery process and report it to the FIA Cyber Crime Wing.
Will an assessment make us “hack-proof”?
No assessment can promise that. We find and explain weaknesses within the agreed scope and time, rank them by risk and show you how to fix them. Security keeps changing, so we recommend retesting after major changes and at least once a year.
Will testing take our website down?
We design tests to avoid disruption and agree a testing window with you — out of business hours if you prefer. We don’t run denial-of-service tests. If anything looks unstable, we stop and call your emergency contact straight away.
Bigger environment, or a compliance deadline?
Tell us what you need assessed and why. We reply with a written scope, price and milestones — and the authorisation form for the system owner. Nothing to pay until you accept.