ATTACK SURFACE
// pricing

Fixed scopes.
No hourly billing.

Four engagements. Each one is priced before it starts, written down, and does not move unless the scope does.

Everything starts at A$99 and goes up with what you actually have. No online checkout — because a price that ignores your environment is a price that is wrong. Tell us the domain and we will tell you the number.

01
External Check

What anyone can see from your domain, today, without touching anything. Twelve passive checks — DNS, email authentication, certificates, headers, exposed hostnames.

  • 12 passive checks, run against your live domain
  • Plain-English report, written by a person
  • Every finding with the command that produced it
  • It's a PDF you can forward to your IT provider
  • No authentication testing
  • No access-control testing
  • No file handling or API testing
  • No internal network
fromA$99one-off

Most businesses stop here after fixing the first three items.

02
Authorised Verification

The part that actually answers the question. With a signed scope, we try to get in — read-only, non-destructive, and we stop the moment we have proof.

  • Login logic and session handling
  • Access control (can user A read user B?)
  • File upload and API behaviour
  • 3-page report + 90-second recording of what we reached
  • Re-test after you fix, within 30 days
  • No denial of service
  • No data modification or exfiltration
  • No persistence or backdoors
  • No lateral movement beyond scope
fromA$499one host, 2-hour window

If we find nothing, there is no invoice.

03
Full Engagement

Outside in, then inside out. Black-box testing from the internet, plus white-box review of your source, configuration and infrastructure.

  • Everything in Authorised Verification
  • Source code and configuration review
  • Infrastructure and cloud posture
  • Privilege escalation paths
  • Prioritised remediation roadmap with effort estimates
  • No social engineering of staff (separate scope)
  • No physical access testing
  • No third-party systems
fromA$1,500black + white box

Priced by surface area. We quote after seeing the inventory, not before.

04
Retainer

The part nobody sells you: proving the fix actually closed what it claimed, and noticing when the surface changes underneath you.

  • Monthly surface watch (new hostnames, cert changes, new exposures)
  • Re-test after every fix, with a one-page result
  • Direct email access — you ask, we look
  • Quarterly summary you can hand to an insurer
  • Not unlimited testing hours
  • Not a 24/7 incident hotline
  • Not a substitute for the initial engagement
fromA$450per month

Requires a completed engagement first. We do not monitor what we have not tested.

How an engagement runs

01
Tell us the domain
One email. No form funnel, no discovery call.
02
We quote before starting
Fixed number based on what we find in the free check.
03
You sign a one-page scope
Read-only. Excluded actions written down explicitly.
04
Report + re-test
Findings with evidence, then verification after you fix.

Questions people actually ask

Why is this so much cheaper than a normal security firm?
Because there is no sales team, no account manager, no city office rent, and no partner who needs a cut. One specialist doing the work is a different cost base. It is not a discount — it is a different shape of business.
Can I just pay online?
No. Every engagement starts with a conversation, because the price depends on what you have. We tell you the number in writing before any work starts, then invoice after the scope is signed.
What if you find nothing?
For Authorised Verification, there is no invoice. For the others, you still get the report — “nothing found” is a result, and it is worth having on paper.
Do you need access to our source code?
Only for Full Engagement, and only if you want the white-box half. The black-box half runs entirely from the internet.
Will you break anything?
No. Testing is read-only: we demonstrate reachability, we do not modify data, we do not install anything. Anything that could cause an outage is written out of scope before we start.
Who actually does the work?
The same person you email. No queue, no subcontractor, no offshore team.

Get a number before you commit.

Send the domain. We reply with a fixed price and what it covers — usually within one business day.

Request a quote →