Your last pentest
was a lie.Scan your website
free. Fix it fast.

Paste a URL. Read-only checks. Clear grade. Then copy a prompt for Cursor, Claude, or your engineers - or ask Bob to walk the findings. No PDF theater.Paste your domain. We grade the public site in seconds (read-only). Copy a fix prompt for your AI coding agent, send it to your team, or chat with Bob. Private until you share.

the reportyour report

One grade.
Every fix.Your security,
in plain English.

Weighted score across 15 passive checks, category breakdown, findings ranked by severity, remediation ready to paste. Below: a live sample of the exact report every scan renders.Every scan becomes a page like this. One grade for the whole site, plain words for what's wrong, and fixes you can copy straight to whoever runs your website. This one is a sample - click around.

methodHow it works

Three easy steps.
Then it stays fixed.

Scan, understand, fix. Scroll right or use the arrows.

1

Scan

Paste your domain. Thirty seconds, read-only, no login. You get a grade.

2

Understand

Every finding in plain words, ranked by what matters, with the fix written out.

3

Fix and prove

Fix it yourself, with your AI tool, or with us. Re-scan. Show the grade.

Swipe or click to see each step →

Step 1

Scan.

Fifteen passive checks on the public perimeter: transport, headers, integrity, exposure. Nothing is sent to your server except normal page requests.Paste your domain. We look at your site the way an attacker would, from the outside, without touching anything. About thirty seconds later you have a grade and a list.

Scan free →
koscak . scan . example.com

Step 2

Understand.

One grade for the site, four category scores, findings ranked by severity with the exact header or record to change. CVSS-tagged where it applies.One grade for the whole site. Four scores for the parts. Every problem explained in one sentence, and the fix written so you can hand it to whoever runs the site.

See a sample report →
A sample report: grade, category scores, ranked findings

Step 3

Fix and prove.

Apply the fixes, re-scan, watch the grade move. Copy the agent prompt into your coding tool, or hand it to us. Then put the grade on your site.Fix it yourself, paste the prompt into your AI coding tool, or let us do it. Re-scan and watch the grade go up. Then show it off.

See what we fix →
C

Before
64 / 100

A

After
95 / 100

threat curveHow we got here

Fifty years of attacks.
Breaking in only got cheaper.

One bar per year. Every era made an attack cheaper, faster and further away: a curious student, then organised crime, then states, now anyone with a subscription. Hover a milestone to see what changed.

Bars: the shape of global cybercrime cost per year, indicative and not to scale. Anchors: McAfee/CSIS $445B (2014) and $600B (2018); Cybersecurity Ventures $3T (2015), $6T (2021), $10.5T (2025 projection); FBI IC3 $16.6B reported US losses (2024). Years between anchors are interpolated. The shape is the point.

caseworkFrom our own work

Small cracks.
Real damage.

Four things we actually found, told the way we'd tell a friend. Tap a step to see how one open door leads to the next, and where a free scan would have caught it.

Two minutes

Which rules
apply to you?

Pick your industry, then your corner of it, then answer the few questions that matter for that corner.

  1. 1Industry
  2. 2Your corner
  3. 3Questions
  4. 4Your picture

    Nearest deadline

    Book the 20-minute call →Or start with a free scan

    Guidance, not legal advice. Penalties quoted are statutory maximums. The first step always costs less than one day of them.

    practiceWho you'll talk to

    Five people.
    One contact. No call centre.

    A small practice. NDA before scope. Findings shared only with you. No conference talks, no case studies, no marketing reuse.A small team. We sign the NDA before we even talk about scope. Findings stay between you and us.

    JurajNIS2 and the lawI read the law so you don't have to. Then I write what the auditor wants to see.
    PhilThe scanner, the reportsI built the scanner. I read every report it produces.
    AmidaHands-on testingI'm the one who tests by hand, and the one who explains what I found.
    PiryYour first callYou'll talk to me first. I make sure the right person picks up next.
    DušanThe numbersI keep the numbers honest: what it costs, what it saves, what it's worth.

    Read-only by default. We never log in or change anything without written authorization.

    90-day evidence retention. Then it is destroyed.

    Standards. ISO/IEC 27001 framework aligned · ISO 9001 practice aligned · NIS2 directive ready

    pricingPricing

    Flat numbers.
    No negotiation.    One price per tier.
    No surprises.

    Start free. Watch the whole estate from €42. Bring in an engineer from €499. Everything beyond is scoped and quoted.Start free. Watch your whole company from €42 a month. Call in a human from €499. Everything else is a custom quote.

    Free

    €0

    3 scans, no card required

     

    Check your own site right now.

    • ~20 read-only checks: transport, headers, secrets, AI paths, SPF/DMARC
    • Instant grade + category scores + plain-English brief
    • Free sample: top fix + sample agent prompt unlocked
    • Free account: all remaining fixes, full agent paste, 3 scans
    • No card to start
    Scan free →

    Monthly

    EUR42

    per month

     

    Unlimited scans, billed monthly.

    • Unlimited scans - never hit the free-scan wall
    • Monitors: re-check after deploys
    • API keys for CI / agent loops
    • Full history + shareable grade reports
    • Cancel anytime
    MOST POPULAR

    Yearly

    EUR432

    per year - save €72 vs monthly

     

    Unlimited scans, priority support.

    • Unlimited scans, any site, any time
    • Priority support
    • Full scan history & score trend over time
    • Works out to €36/mo - cancel anytime

    Human-led engagementsWhen you want a person, not a scanner

    Personal pentest

    EUR499

    excl. VAT

    One engineer, one authorized target, enterprise-grade report.A real engineer tests your site by hand and explains every finding.

    • Authorized, scoped, read-only by default; exploitation only under written rules of engagementOnly after you confirm you own it and sign the rules of engagement
    • Every finding hand-verified, chained to an attack path, CVSS-scoredEvery problem confirmed by a person and explained in plain words
    • Engineer-ready remediation steps and a leadership summaryFixes for your developers, a one-page summary for your boss
    • 30-minute debrief call and one retest after fixesA call to walk you through it, and a re-check once you fix things
    • Delivered within 5 business days
    Book a pentest →

    ProgrammesFix it with us

    Custom

    scoped after a 20-minute call

    Remediation, NIS2 readiness, phishing simulation, retained security lead.We fix what we found, get you ready for NIS2, and train your people.

    • Remediation with retest until the grade holdsWe help fix it, then check it stays fixed
    • NIS2 readiness: gap analysis, documentation, risk analysis, audit preparationNIS2: find the gaps, write the documents, get ready for the audit
    • Phishing simulation and staff trainingTest your people with a safe fake phishing email, then train them
    • Retained cyber-security manager as a serviceA security lead on call, without hiring one
    Book a call →
    Flat pricesYou know the number before you say yes. No scope-creep billing.
    No fake certificationsFramework aligned, not certified by. We say which is which.
    Your systems, your sayNothing runs against a system you do not own. Verified ownership and signed rules first.

    Prices exclude VAT. Nothing runs against a system you do not own.

    free scan

    Check your site. Fix with AI or your team.

    Free grade at the top of this page. Copy an agent prompt for Cursor/Claude, share with engineers, or ask Bob. Sign in for 3 free scans and a private dashboard.

    Check my site free → Sign in

    Human pentest and remediation: see pricing above.

    insights

    Field notes.Field notes. When something breaks.

    Short, opinionated, shipped the day something real happens. No fluff, no sponsored posts, no guessed takes.Short, opinionated, written the day something real happens. No fluff, no sponsored posts, no guessed takes.

    View all posts ->

    reading as
    consumer pro