Website security · external assessment · fixed price
An external security assessment of your website or web shop. We test it from the outside, verify every finding by hand and send a plain-language report with what to fix first.
No access, agent or installation needed. We test only what is publicly reachable, with your written permission.
When companies call us
Why now
These are the dates your customers, partners and auditors are counting down to.
PCI DSS 4.0 · payment-page scripts
Requirements 6.4.3 and 11.6.1: control and monitor every script on the checkout page.
PCI Security Standards Council
EU Cyber Resilience Act · reporting
Manufacturers must send an early warning within 24 hours of an actively exploited vulnerability.
Regulation (EU) 2024/2847
Poland KSC (NIS2) · ISMS and S46
Covered entities must run an information security management system and be connected to S46.
Rödl & Partner · CMS
EU Cyber Resilience Act · full application
Security requirements for products with digital elements sold in the EU, including vulnerability handling.
Regulation (EU) 2024/2847
How the assessment works
A fixed-price product with a fixed deliverable. Fixing what we find is a separate, optional step.
Rules we work by
Scope and permissionday 1
We list the domains and systems in scope, agree what is out of scope, and sign a short written authorisation.
External assessmentdays 1–4
Reconnaissance, TLS and security headers, outdated components with known vulnerabilities, exposed admin panels and backups, OWASP checks on forms, login and checkout, third-party scripts, leaked credentials.
Report and readoutday 5
Findings by severity with how we found each one, what it means for the business and how to fix it. A one-page summary and a 60-minute call.
Fixingoptional
We fix the findings together with your developers or hosting provider, retest and confirm in writing — or your team fixes them and we retest.
The report
No 200-page scanner export. Every finding says what it is, how bad it is, where it is and what to do about it.
| Severity | Finding | Fix |
|---|---|---|
| Critical | Checkout page loads a script from a domain not controlled by you. Card data can be read by a third party.Fix: Remove the script, rotate payment keys, add a content security policy. | Remove the script, rotate payment keys, add a content security policy. |
| High | Admin login reachable from the internet, no rate limiting, no two-factor authentication.Fix: Restrict by IP or VPN, enable 2FA, limit login attempts. | Restrict by IP or VPN, enable 2FA, limit login attempts. |
| Medium | Two plugins with publicly known vulnerabilities, last updated in 2022.Fix: Update or remove, then set a monthly update routine. | Update or remove, then set a monthly update routine. |
Where this comes from
The people who run the assessment build and operate web systems for a living. They know what a fix costs, so the plan is realistic.
E-commerce · name on request
Before Bonsay, our delivery lead ran the response to a card-skimming attack on a live store: containment, forensics, remediation, hardening and a retest.
FAQ
It is an external assessment of what the internet can see, verified by hand. It is not a penetration test of your internal network and not a compliance certificate. If you need a certified pentest, we tell you so and can work alongside the tester to fix what they find.
No. We do not run denial-of-service tests, brute force or data extraction. We verify findings with the least intrusive request possible, only after you sign a written authorisation.
The list of domains, a signed one-page authorisation and a contact person. No access, agent or installation is needed.
No single test does. It gives you an independent, dated record of your external exposure and a fix plan — useful evidence for an ISMS, a supplier questionnaire or an insurer.
Your choice. We can fix it for a fixed price or hourly with your developers or hosting provider, or your team fixes it with the report in hand and we retest.
Next step
On a 30-minute call we look at the site, tell you if the assessment makes sense for it, and send a fixed price and a one-page authorisation to sign. Nothing is scanned before you sign.
You will talk to
Gleb Zamyslovsky
Executive Officer · Warsaw
One reply within a business day: questions, a fixed price, or an honest “not worth it”. No account managers in between.
