Services
Three packages that build on each other, and a code scan you can add on top. Whatever the package, the job ends with a written report.
Package 1
Basic
External security check
I look at you from the outside, the way an attacker would. I only check what is public and do not touch your systems.
Good for
For small businesses and associations that want an overview.
Get a quote for BasicWhat you get
- Review of everything visible from the outside
- Check of who can send email in your name
- Check of encryption and configuration
- Search for leaked passwords and keys
- Report within 5 working days of the test
- Retest of fixed findings within 30 days
See what I check
- DNS
- the setup that connects your domain to your servers and email.
- SPF, DKIM and DMARC
- three settings that decide whether others can send email in your name.
- TLS and certificate
- the encryption between visitors and your site.
- Security headers
- instructions to the browser that block known attacks.
- Platform
- which system the site runs on, and whether it is up to date.
- Public code
- whether passwords or API keys have been published by mistake, for example on GitHub.
Package 2Recommended
Extended
Login, API and your digital footprint
Everything in Basic, plus a test of the application itself: login, user access and API. I also find out what is publicly available about you.
Good for
For webshops and businesses with logins, customer data or an app.
Get a quote for ExtendedWhat you get
Everything in Basic, plus:
- Test of login and user access
- Test of your API
- Overview of what the internet knows about you
- Report walkthrough in a meeting
- Retest of fixed findings within 60 days
See what I check
- OSINT
- a map of what is publicly available about you: old subdomains, staff details and leaked data.
- API
- the connections your app uses to fetch and store data.
- Access control
- whether a user can see or change something they should not have access to.
I do not change or delete any data along the way.
Package 3
Complete
In-depth security test
Everything in Extended, plus tests that go beyond the standard check and show how far an attacker could get.
Good for
For businesses where downtime or a data leak would be costly. Requires a separate agreement and written permission.
Get a quote for CompleteWhat you get
Everything in Extended, plus:
- Deeper testing that goes beyond the standard check
- Timing agreed in advance, so your operations are not disrupted
- Retest of fixed findings within 90 days
See what I check
- Fuzzing
- I send large amounts of unexpected data to the system to find errors.
- Controlled intrusion test
- I try to get in the way a real attacker would, within the agreed limits.
We agree on the timing, so any impact on operations happens when it suits you.
Compare the packages
| What is covered | Package 1Basic | Package 2Extended | Package 3Complete |
|---|---|---|---|
| What you get | |||
| Report with findings and recommendations | Included | Included | Included |
| Report within 5 working days of the test | Included | Included | Included |
| Report walkthrough in a meeting | Not included | Included | Included |
| Retest of fixed findings within | 30 days | 60 days | 90 days |
| What I check | |||
| Everything visible from the outside | Included | Included | Included |
| Whether others can send email in your name | Included | Included | Included |
| Encryption and configuration | Included | Included | Included |
| Leaked passwords and keys | Included | Included | Included |
| Login and user access | Not included | Included | Included |
| Your API | Not included | Included | Included |
| What the internet knows about you | Not included | Included | Included |
| Deeper testing than the standard check | Not included | Not included | Included |
Add-on: code scanning (SAST)
SAST stands for static application security testing. I go through your source code looking for vulnerabilities and for secrets, such as passwords written directly into the code. The code scan can be added to any of the three packages.
The report
The report is written so you can read it without a technical background. Each finding gets a severity level and a recommendation you can act on straight away. Your developer gets the technical details in an appendix.
Questions and answers
Can the test take our website down?
It is very unlikely. In Basic and Extended, I test without changing data and without putting heavy load on the site. Complete goes deeper, so we agree on a time when any impact does the least harm.
Do we need technical knowledge to use the report?
No. The report is written for the person making the decision. Each finding has a severity level and a recommendation in plain language. The technical details go in an appendix you can pass on to your developer.
What does it cost?
It depends on what needs testing and which package you choose. Tell me about your website, and I will send you a quote. No VAT is added, because Akkurt.dk is not VAT registered.
How long does it take?
How long the test itself takes depends on the scope, and that is stated in the quote. You get the report within 5 working days of the test.
What happens if you find something serious?
I contact you straight away, before the report is finished. You find out what the problem is and how to close the gap.
What do you need from us?
Written permission from the owner of the system, and a contact person I can reach during the test. If the package needs access, for example to a login, I also need a test user.
Is our data safe with you?
Yes. Findings and data stay between us and are not shared with anyone else. Test data is deleted when the job is finished.