External security
Know what your public systems expose.
Choose a narrow first snapshot or a deeper, analyst-intensive review of your defined Internet-facing footprint. Both use authorized, non-destructive checks and practical reporting.
Choose a starting point
Match the review to your public footprint.
Tell us which public domains and IPs you own or are authorized to assess, and what decision the findings need to support. We will confirm scope before any checks begin.
Two practical options
- QuickCheck for a limited snapshot of one primary public domain and a prioritized summary.
- Full assessment for a defined broader footprint, deeper analyst review, and an executive report with a remediation roadmap.
Neither option is a penetration test. Final scope and fee are agreed before work starts.
Limited entry offer
External Security QuickCheck
An affordable external security snapshot for smaller Canadian businesses that want to understand their most visible Internet-facing risks.
Starting at $995 CAD
Up to one primary public domain. The QuickCheck is deliberately limited in scope and is not the full assessment.
Included in the QuickCheck
- Safe external vulnerability checks
- TLS and certificate review
- Basic web security configuration
- WordPress checks where applicable
- Analyst-reviewed findings and prioritized summary report
Broader assessment
External Security Assessment
For SMBs with a broader Internet-facing footprint that need a deeper current-state review, analyst-checked findings, and prioritized remediation guidance. Public domains and IPs are defined in the statement of work.
Starting at $2,500 CAD
Typical turnaround: 1–2 weeks after scope and authorization are confirmed. Timing varies with footprint and access.
Included in the full assessment
- External service exposure and safe vulnerability scanning
- Web configuration, TLS, and certificate analysis
- WordPress review where applicable
- CDN and WAF observations
- Analyst validation and false-positive reduction
- Executive report, technical appendix, and prioritized remediation roadmap
WordPress where relevant
Review visible WordPress exposure.
When WordPress is in scope, safe checks may include core, plugin, and theme version exposure; XML-RPC; public registration; user enumeration; directory listing; security headers; and exposed backup or configuration files.
Neither service is a penetration test. We do not use destructive testing, password brute forcing, or exploitation. Final scope and fee depend on authorized assets.
After the assessment
Need help executing the roadmap? Explore ongoing security leadership.
Practical answers
Frequently asked questions
Who is the QuickCheck for?
It is a limited external snapshot for a smaller business with one primary public domain. A broader footprint may need the full assessment.
Is this a penetration test?
No. Checks are authorized, controlled, and non-destructive. We do not brute-force passwords or exploit systems.
What do you need to begin?
We confirm the public assets, ownership, authorization, and scope before any testing.
What will we receive?
You receive analyst-reviewed findings and a prioritized summary. The full assessment adds an executive report, technical appendix, and remediation roadmap.
Will this confirm that findings from an earlier assessment were fixed?
The published assessment reports on the agreed current public footprint. It does not include a finding-by-finding comparison with an earlier report. If you need that comparison, tell us before we quote; we will first review the evidence, authorized assets, method, and feasibility, then confirm whether separate work is possible.
Discuss your scope
Get a clear next step.
Tell us about your business and what you need to understand. We will confirm scope, timing, and the most useful engagement.
When you inquire, tell us how many public domains are in scope and whether you need a current-state view or a comparison with earlier findings. Please do not send sensitive reports through the website form.