Security scans
Three reports, priced by how the audit actually works. OWASP is a picture of one site today. PCI wants a scan every quarter. SOC 2 Type II is a stretch of months, not a screenshot. A CPA firm signs the SOC 2 letter. A QSA signs the official PCI letter. We produce the evidence those letters are built from.
The scan runs from an AWS server outside your network. It is not run from inside your LAN.
Prices
- OWASP, $1,500. Passive external scan of one public site, mapped to the OWASP Top 10, plus the written findings. An active test is a separate window we agree on first.
- PCI readiness, $3,500, or $500 per month. External technical scan and a gap sheet against PCI DSS. This is evidence for your SAQ. It is not a QSA Report on Compliance.
- SOC 2 program, $7,500, then $1,500 per month. Readiness mapped to the Trust Services Criteria, then a monthly evidence pack for the audit window. The CPA firm still issues the opinion.
The auditor is billed by the auditor. These prices are the engineering work around the letter, not the letter itself.
Your reports
Existing customers, including Freightgate, sign in to read their scans and answer a finding when a response is required.
New engagement: contact us with the URL and, if the report is about AWS, read-only access to that account.