Managed web security
that starts by breaking in.
WAF tuning, bot rules, rate limiting, quarterly scans, OWASP coverage. We get sent that same scope most weeks, and it was written for an attacker who looks up published vulnerabilities and tries them. That is not who shows up.
So we do it the other way round. We attack your sites first, find what is actually wrong, then protect those specific things while your developers fix them. Everything on the list above is included — and we will also point out that the list only covers your servers, while the shortest route to your website's code usually runs through your staff.
The scope you sent us
Your line items, answered one at a time
Managed web security enquiries arrive as almost exactly this list, so here it is with a straight answer against each row. Most of it we include. Two rows we would hand back to you and argue about, which is the honest version of a quote.
Cloudflare WAF management and ongoing rule tuning
We manage and tune it, including dynamic rules driven in real time from what we are actually seeing in your traffic and logs. The caveat is that we get past commercial WAFs on nearly every engagement we run, so we will not let you believe the WAF is the control protecting your site.
Bot management — monitoring, mitigation and custom rules
Handled at the edge and on the server together. Automated traffic that never reaches a rule at the edge still shows up in the server and application logs, which is where we are also watching.
DDoS and threat monitoring
Your existing CDN absorbs the volumetric side; we monitor, alert and investigate. Application-layer floods that look like legitimate requests are the ones that need a human and a baseline, and those are ours.
Incident alerting, investigation and escalation support
This is the SOC, and it is the part of the scope we take most seriously. Every alert arrives explaining what was found, what needs to be done, roughly how long that should take, and a quick fix where one exists.
Rate limiting, IP reputation blocking and false-positive mitigation
Built into Sentinel, with the confidence threshold required to act set per site by you. There is a monitor-only mode that shows you what would have been blocked until you are ready to turn enforcement on.
Vulnerability scanning for the websites
Security Validation runs nightly across every covered server and checks all the code it finds there — custom and third-party alike — for known vulnerabilities and for signs of supply-chain compromise. Included, and genuinely important once somebody has a foothold. Still not the thing we would sell you as the service.
Quarterly automated / low-depth penetration testing
Replaced with a re-run of the full engagement. Once your scope is known, testing it again costs us far less than the first time, so you get the same depth on the recurring schedule rather than a reduced version of it.
OWASP Top 10 coverage
Covered, plus the business-logic abuse that sits outside it. On an e-commerce site that second part is where the money is: price and discount manipulation, cart and checkout logic, access control between customer accounts, order tampering.
Security reporting and remediation recommendations
Full technical report and an executive summary, delivered within hours of testing finishing rather than a week later, with effort estimates against each item so your developers can plan the work.
12/6 active monitoring, business hours
You get 24/7, and not as an upsell — there is no cheaper part-time tier to sell you. The monitoring does not bill by the hour and attackers do not keep your office hours.
SLA-based response times for security incidents
Measured in seconds, not hours. Detection fires, the investigation starts and a human is alerted in the same moment — the design is real-time, so there is no queue for a response time to be measured against. Whatever contractual numbers you need for your own obligations, we will put in writing.
And the two rows that were not on the list
These are the ones that decide whether the rest of it holds. Neither appears on a single managed-web-security scope we have been sent.
Every server, not just the live one
A high-availability pair behind a CDN routinely hides a staging or failover node sitting on the same database, patched on a different schedule and watched less closely than production. We have gone after that node instead of the live one more times than is comfortable. If it can reach your data it is in scope, and if it is not in the device count it is not protected.
Your staff, not just your servers
This is the largest gap in the scope as written. A server-only engagement leaves the workforce untested, and compromising one account is frequently a shorter path to your website code than attacking the web server ever was — because that account has access to the systems, the repositories and the build pipeline, which is where a supply-chain attack starts.
The part we push back on
A scan tells you which public holes you have. Nobody is attacking you with those.
Vulnerability scanning and quarterly low-depth testing are the two items we will not sell as the service. Both answer the same question — which published weaknesses are present — and that question has a known answer, which is why it can be automated and sold cheaply by the month.
Our systems are not allowed to use a CVE to get in. We do not go for the easy win, because an attacker holding your customer database did not get there with something that already has a patch available. We look at a target the way a programmer doing a code audit and a red team engineer both would: what can I do to this? Not what did somebody else already find.
The scanning still runs — nightly, CVE and supply chain, across everything we monitor. It is table stakes included in the platform. It is not the thing that protects you, and we would rather tell you that before you pay us than after.
Closed source is not a control
One recent client had paid $88,000 in development fees for a custom build and been told it was secure because the source code was closed. It made no difference to our methods or our results. A vulnerability scan would have returned them a clean report.
Security through obscurity is finished. It depended on an attacker needing time to understand an unfamiliar system, and that is precisely the part that no longer takes time.
A WAF in front of it is not either
Across the twelve live sites in our last testing program, every one sat behind a commercial WAF in blocking mode. It did not change the outcome on any of them. That is not a criticism of the WAF — it blocked the generic scan it was built to block, exactly as designed. It was never built for business-logic abuse or for an exploit written against your code an hour ago.
The numbers from that programHow it works
Test it, prove it, then block it
Offence feeding defence is not a philosophy here, it is the wiring. What the testing finds is literally what configures the monitoring.
We test the sites first
A tester drives our swarm against your live sites and writes the exploits during the engagement. Our systems are not permitted to reach for a published CVE to get in — they are told to try harder. What comes back is a list of things that actually worked, each with proof.
The findings become blocking rules
Sentinel is configured from those proven findings, so it knows the exact request that got in — because it is the request we sent. A source that burns an attempt against one host loses access to every protected server at once, not just the one that saw it.
Both sides get watched, not just the edge
Web server, operating system, database and the logs are monitored together in one panel. A WAF only ever sees what arrives at the front door; it cannot tell you what your application then did with it. That gap is where the engagements we run tend to live.
The investigation closes itself
When Sentinel acts it opens a forensic investigation across your infrastructure to establish whether anything got through before the block landed. If nothing did, it closes its own case. You hear from us when there is something to hear about.
Every line of code on the server gets checked nightly
Security Validation inventories what is actually installed on each covered server — your custom application, its dependencies, the operating system packages — and checks all of it against known vulnerabilities and for signs of supply-chain tampering. This is the part that matters once somebody has a foothold, because an inventory of your weak dependencies is the first thing they go looking for.
New techniques land in detection the same day
Our cluster researches attack methods and builds payloads for the red team side continuously. We build it, prove it, then write the detection — so the gap between a technique existing and your sites detecting it is minutes to hours, not a vendor release cycle.
The alert tells you what to do
Every alert is enriched before it reaches you: what was found, what needs doing about it, how long that should take, and where possible a quick fix to get you running again. A severity score on its own is just a thing to look up.
The gap nobody scopes
You are hardening the front door while the back one stands open.
Every scope we are sent is about servers. Servers are worth protecting, and none of this argues otherwise. But if the question is how someone actually ends up with your website's source code, attacking the web server is rarely the short route.
The short route is a person. So that is the route we take, because the job is to find a better way in rather than the expected one.
Recon the workforce
The same open-source research a real attacker does on your staff — who they are, what they do, what they would plausibly be expecting to receive.
Build the campaign
PhishAI builds something bespoke per target, on a real-looking domain with a fully built site behind it. Nothing off a template. They have not seen our phishing emails before.
Use what the account reaches
One compromised account is not the objective. What it can reach is — the systems, the source code, the repositories, the deployment pipeline.
Walk in through the build
Code committed through a legitimate account arrives on your servers as a trusted deployment. No WAF rule applies to that, and no server-only scope would have caught the path to it.
This is why Security Validation matters
A supply-chain attack does not look like an attack when it lands. It looks like a dependency update. Security Validation inventories every piece of code on your covered servers nightly — yours and everybody else's — and checks it for known vulnerabilities and for signs of tampering, which is the only place that class of compromise becomes visible.
Nobody gets fired over it
The single biggest blocker to authorising staff testing is what happens to the person who clicks. So it is contractual: no employee is disciplined or dismissed as a result of a social-engineering test we run. The training is the weak link, not the people, and a test that costs somebody their job teaches the organisation to hide things from you.
Coverage and response
A queue is where attacks get missed.
Coverage gets rationed to business hours for one reason: investigation used to mean a person reading logs. An alert sat in a queue until somebody got to it, and that was survivable while the attacker on the other end was also a person working at human speed.
That is not the shape of the problem any more. Attacks are assembled and run by tooling that does not pause to think, and the gap between the first probe and the damage being done has collapsed. An alert that waits four hours for triage is not late. It is irrelevant — whatever it was warning you about has already finished.
So our investigation is not a queue. Detection fires, the investigation starts and a human is alerted in the same moment — response time measured in seconds, because the design is real-time rather than because somebody is sitting watching a screen. It then carries to one of two conclusions: confirmed false positive, or verified attack. Those are the only two places an investigation is allowed to stop.
A human is in that loop and frequently driving it. The point is not that software replaces the analyst — it is that the analyst stops being the bottleneck between something happening and somebody knowing what it was.
This is what an answer to “what are your SLA response times” looks like when the honest answer is seconds. Whatever contractual numbers you need for your own obligations we will put in writing, but the number is not the mechanism — the mechanism is that nothing waits for a shift to start.
That is also why there is no twelve-hours-a-day tier to sell you. Nothing here bills by the hour, so there is no version of this that costs us less by looking away on a Sunday — which is, predictably, when somebody who has been watching your site all week tends to move.
We built the platform in this shape because nothing we could buy protected a site from us when we attacked it. The old model — scan quarterly, alert on signatures, triage on Monday — does not fail occasionally. It fails structurally, because every part of it assumes an attacker who is waiting.
Where an investigation ends
Confirmed false positive
The case closes itself and you never hear about it. You are not handed another notification to work through.
Verified attack
You get the alert with the evidence attached, the source is already blocked across every protected server, and the alert tells you what to fix and roughly how long it should take.
There is no third outcome where it sits at “needs review” until somebody has a free afternoon.
What runs without anyone asking
- Continuous threat hunting across every monitored system
- Nightly CVE and supply-chain scanning
- Sentinel enforcement, once the 72-hour traffic baseline is learned
- Real-time forensic investigation on every detection, across all your infrastructure
- AI enrichment on every alert before a human sees it
- New attack techniques turned into detections as our red team side builds them
Pricing
Published, and the same for everyone
We publish prices while most of the industry hides them, and we quote every client the same rate. There is no discount for a longer commitment, which is the only honest version of that sentence — there is no penalty for a short one either.
Step one
Test the sites
From $1,400
one-time, priced by scope
- OWASP Top 10 plus business-logic testing
- Technical report and executive summary
- Remediation retest at no extra charge
- 90-day Protection Window included at no charge
Step two
Test the people
Per campaign
plus a per-person rate — a reduced rate when it runs alongside a test
- Open-source recon across your workforce
- Bespoke campaigns, not templates
- Where it leads: code, repositories, pipeline
- Contractually, nobody gets fired over it
Step three
Keep it all watched
From $150
per month — SOC Starter, up to 5 servers and 3 network devices
- Free for the first 90 days with any engagement
- 24/7 SOC with real-time investigation included
- Sentinel, plus nightly CVE and supply-chain validation
- Managed WAF tuning, bot rules, rate limiting, IP reputation
Step four
Test it again, on a schedule
Monthly
a retainer, not a lump every few months
- The full engagement again, not a lighter automated pass
- Cheaper than the first because your scope is already known
- New findings feed straight back into the blocking rules
- One rate to compare — nothing to annualise yourself
Invoiced however suits you
Everything ongoing is one monthly figure, and you choose how often it is billed. The annual total is identical every way — there is no prepay discount and no surcharge for staying monthly, because a prepay discount is a minimum term wearing a different hat.
Monthly
12 invoices
same annual total
Quarterly
4 invoices
same annual total
Every six months
2 invoices
same annual total
Annually
1 invoice
same annual total
No setup fee. Monitoring is priced by how much infrastructure it covers, and the rung you land on has headroom in it — you are not re-quoted for adding a server. Count every server that can reach your data, including staging and failover nodes; if a site exposes more than web traffic, or we find more in scope than the brief described, the testing price moves with it and you see that before you agree to anything.
Terms
We don't need to trap you
Requests for quote usually ask for our best monthly rate on a twelve-month agreement. We do not have one, because we do not do long-term contracts and we do not believe in them.
Billing is monthly. Thirty days' notice for hand-off. If a client does not like us, or we do not like a client, we part ways and we will help you pack your bags and load the car. We have never needed that clause, because we do the job well.
A company confident enough to publish its prices and hand you a real report with no email gate does not need a minimum term to keep you. We would rather you stayed because it earned its place.
One price for everyone
Published rates, quoted the same to every client. No better deal behind a longer signature.
Monthly, 30 days’ notice
In writing, on this page, before you ask for it.
Built around your gaps, not a package
If we get in and find a gap nothing on the market closes, we build something that does. That is where AlertMonitor, our SOC and SwarmPT all came from.
We will tell you if you don’t need it
If the testing comes back clean enough that the protection is not worth your money, that is what you will hear.
Questions we get asked
Find out what is actually wrong first
Put your sites through the estimator for a real number in under a minute, or talk to us and we will tell you what we would do and what we would not bother charging you for.