Cybersecurity07 / 10
Find the gapsbefore someone else does.
We test your applications and infrastructure, prepare you for the audits your clients ask about, watch for attacks and fix what we find, with the engineering team that understands how the product works.
- Pricing
- $5–8k per level, or by task
- Timeline
- 1 week per level
- Delivered by
- Auvorent, in-house
When to call us
When security becomes a sales question.
Usually it starts with a questionnaire from a client you want to win.
- 01
An enterprise client sent a security questionnaire you can't fully answer.
Assessment, documented controls and evidence you can share.
- 02
You've never had an outside party try to break in.
Authorised penetration testing with a remediation plan.
- 03
SOC 2, ISO 27001 or GDPR keeps coming up in deals.
Gap analysis and readiness work ahead of an independent audit.
- 04
If something happened tonight, nobody would know.
Logging, detection rules, monitoring and an incident response plan.
Layers of defence
Four lines of work. Every layer covered.
Your exposure sits in layers, from people and policy at the edge to data at the core. Choose a line of work to see which layers it covers and what you receive.
Assessment & penetration testing
Vulnerability scanning and authorised penetration tests against your applications, APIs and cloud, with findings ranked by risk.
You receive
- Findings report ranked by severity
- Remediation plan
- Retest of fixed findings
People & policy(not covered by this line)
- Security policies
- Access reviews
- Awareness training
- Vendor risk
Network & cloud(covered)
- Cloud configuration
- Network exposure
- Secrets management
- Backups
Applications & APIs(covered)
- Authentication and sessions
- Input handling
- Dependencies
- API authorisation
Data(covered)
- Encryption at rest and in transit
- Personal data mapping
- Retention
- Audit trails
Scope
What the work covers.
Assess & test
- Security assessment
- Vulnerability scanning
- Application and API penetration testing
- Cloud configuration review
- Retesting after fixes
Comply
- SOC 2 readiness
- ISO 27001 readiness
- GDPR gap analysis
- Policies and evidence
- Security questionnaires
Monitor & respond
- Centralised logging
- Detection rules and alerting
- Incident response plan
- Tabletop exercises
- Incident support
Engineer & advise
- Secure code review
- Security checks in CI/CD
- Cloud and access hardening
- Fractional CISO (vCISO)
How it runs
Assess, prioritise, fix, prove, watch.
Every step ends with something you can review, keep and use.
01
Scope
Agree targets, rules of engagement and written authorisation for any testing.
You getSigned scope and authorisation
02
Assess
Review configuration, code and access; scan and test for exploitable weaknesses.
You getFindings ranked by risk
03
Fix
Remediate in order of risk, with our engineers or alongside yours.
You getRemediation log
04
Prove
Retest fixes and assemble the evidence clients and auditors ask for.
You getRetest report and evidence pack
05
Watch
Monitoring, alerting and a rehearsed response plan, reviewed monthly.
You getMonthly security report
Low Cost Leadership
Priced by level. Built by the task.
$5–8kper level1 week of implementation each
Levels 3 to 10 each carry a defined task list and a price between $5,000 and $8,000. Every task is priced from its effort at $30 an hour, so a custom plan costs exactly what its tasks do.
Plan builder
Cybersecurity
- Level 03Defined · Hardened, documented, logged.Web & API hardening · Brute-force & abuse protection · Injection protection · Dependency upgrades & CVE fixes · Security event logging · Security policies & controls inventory$6,2401 week
- Level 04Managed · Vulnerabilities found before attackers find them.Device trust & anomaly alerts · Session hijack & replay protection · MFA for admin accounts · Vulnerability scanning & patching · Security awareness training$6,1801 week
- Level 05Controlled · Sensitive data sealed. Incidents rehearsed.Field-level PII encryption · Tamper-evident audit trail · Centralised logging & dashboards · Incident response plan & tabletop · Decoy early warning$7,5001 week
- Level 06Monitored · Attacks noticed while they happen.SIEM & detection rules · Monitoring & alert routing · Login risk scoring & lockout · Network & database monitoring$7,6801 week
- Level 07Proactive · Testing yourself before others do.Penetration test · Threat modelling · Risk register · Secure code review · SOC 2 readiness gap analysis · Container & cloud scanning$7,8001 week
Estimate
Level 2 → 7: 26 tasks, 5 weeks
$35,400total
- Timeline
- 5 wks
- Tasks
- 26
- Effort
- 1,180 h
- Level 3 · Defined
- Web & API hardening (30 h, $900)
- Brute-force & abuse protection (30 h, $900)
- Injection protection (28 h, $840)
- Dependency upgrades & CVE fixes (36 h, $1,080)
- Security event logging (44 h, $1,320)
- Security policies & controls inventory (40 h, $1,200)
- Level 4 · Managed
- Device trust & anomaly alerts (44 h, $1,320)
- Session hijack & replay protection (56 h, $1,680)
- MFA for admin accounts (24 h, $720)
- Vulnerability scanning & patching (52 h, $1,560)
- Security awareness training (30 h, $900)
- Level 5 · Controlled
- Field-level PII encryption (60 h, $1,800)
- Tamper-evident audit trail (40 h, $1,200)
- Centralised logging & dashboards (64 h, $1,920)
- Incident response plan & tabletop (56 h, $1,680)
- Decoy early warning (30 h, $900)
- Level 6 · Monitored
- SIEM & detection rules (90 h, $2,700)
- Monitoring & alert routing (60 h, $1,800)
- Login risk scoring & lockout (50 h, $1,500)
- Network & database monitoring (56 h, $1,680)
- Level 7 · Proactive
- Penetration test (70 h, $2,100)
- Threat modelling (40 h, $1,200)
- Risk register (30 h, $900)
- Secure code review (30 h, $900)
- SOC 2 readiness gap analysis (64 h, $1,920)
- Container & cloud scanning (26 h, $780)
Indicative. Each task is priced from its effort at $30 an hour; your fixed quote follows the assessment. Third-party licences, monitoring subscriptions and auditor fees are separate.
Our own operations run on AI
Research, documentation, test generation, reporting and handovers run on AI-assisted workflows inside Auvorent, reviewed by people. That overhead never reaches your invoice.
In-house, not resold
Every service on this site is delivered by the Auvorent team. No subcontracting margin sits between you and the work.
Hours you can see
Time is logged by role and reported monthly, so you can see where every hour went and what it produced.
- Projects
- Milestones, or time and materials invoiced monthly in arrears
- Retainers & support
- Invoiced monthly in advance
- Every engagement
- Scope, hours and acceptance agreed in a Statement of Work
Estimates on this site are a starting point, not a quote. Scope, hours and price are agreed in your Statement of Work.
Questions
Before you ask.
Are you certified?
We don't claim certifications. We prepare your organisation for SOC 2, ISO 27001 and GDPR assessments; an independent auditor you appoint issues any certification.
Is penetration testing safe for production?
Testing is scoped in writing, including targets, timing and techniques that are out of bounds. Where risk is high we test against a staging copy.
Is monitoring 24×7?
Monitoring and response run during business hours by default. Extended or 24×7 coverage applies when it is written into your SOW.
Can you fix what you find?
Yes. Fixing is what the levels are: each task in a plan is implemented by the same team that assessed it.
Do you need access to our systems?
For assessment and remediation, usually code, cloud configuration and logs. Access is agreed in writing and limited to what the scope needs.
Next step
Tell us what you need to prove, and to whom.
What happens next
- 01We read every enquiry and reply by email.
- 02A short call to understand the work.
- 03A written scope with hours and the rate.
Prefer email? clientsuccess@auvorent.com