Several areas of security, one report with priorities
External surface, web apps, the human factor and access under one scope. You get one report with priorities instead of three different ones.
When separate assessments stop adding up to a picture
You can order a pentest, a scan and an access review separately. The problem is that you end up with three reports, three prioritisations and no shared conclusion about the company's level of risk.
One agreed boundary
Instead of several separate arrangements — one document recording everything we test.
Risks compared against each other
A problem in the application and a weak spot in access end up in one list rather than in different reports.
One accountable party
There is no need to reconcile the results of different contractors and work out who is responsible for what.
The modules that can be included
This is not a fixed package. We include only the modules that match your attack surface.
External Attack Surface Review
What can be seen about the company from the internet and which points on the external surface need attention.
Vulnerability Assessment
Managed scanning of the external perimeter for known vulnerabilities and unsafe configurations, with manual analysis.
Web application and API penetration testing
Manual testing of the application: authentication, access rights, business logic, linked attack scenarios.
Phishing simulation
A controlled test of how the team responds to realistic social engineering scenarios.
Security Assessment
Accounts, cloud services, roles, access rights and the processes that remain under the company's control.
Executive Security Review
The results from every area brought together in a form suitable for decisions at management level.
When a programme fits better than a single service
- Several digital products or services at the same time
- A noticeable external perimeter and applications of your own
- Web/API, employees and cloud access together
- The company is scaling quickly
- You need an independent snapshot across several areas at once
- Preparing to move into the enterprise segment
- After a significant change of architecture or a migration
- Responsibility for security is spread across teams
What the company gets
One consolidated picture of risk with priorities instead of a stack of separate reports.
One picture of the risks
The results of every module are brought into one list instead of being scattered across separate documents.
Confirmed findings
What we actually verified within the agreed boundaries, not a list of assumptions from a tool.
Priorities
What is critical, what is important and what can wait — with an explanation of why.
Technical detail for the team
Specifically what to change, in a form engineers can work from.
A summary for management
A separate level of explanation for the people deciding on budget and priorities.
Walkthrough and retest
We go through the results together. We re-check the fixes within the agreed scope of work.
A programme or a single service
One clear task? Take a single service. The program is for when there are several areas.
| Format | Nature | Answers the question |
|---|---|---|
| External Security Review | Passive, before authorisation | What is visible from the outside at all, and whether it is worth going deeper |
| Vulnerability Assessment | Active, after authorisation | Which known technical issues exist across the broad perimeter |
| Pentest | Active, manual work | Whether it is genuinely possible to get inside the application, and exactly how |
| Security Assessment | Configuration and processes | Whether accounts, access and cloud services are configured safely |
| Phishing simulation | The human factor | How the team responds to social engineering |
| Veiltrack Security Program | Several areas, one set of boundaries | What the company's overall level of risk is and where to start |
Frequently asked questions
No. We shape the programme after a short review, around the company's real attack surface. If you have no web application of your own, application pentesting will not be in the programme. There is no sense in paying for modules that test nothing.
One agreed set of boundaries instead of several separate arrangements, one shared prioritisation of findings across all areas, and one accountable partner. Risks from different areas are compared with each other instead of living in separate reports.
No. A Red Team engagement is a separate format with separately agreed boundaries, for large and complex infrastructures. It is not automatically part of the programme.
No. Booking a call is only a meeting. Every active module of the programme begins only after the boundaries are agreed and authorised in writing.
The price depends on the set of modules and the size of the assessment, and is fixed before work starts.
Book a 30-minute review call
A short 30-minute conversation: we go through your attack surface and put together the programme for your situation.