Custom quote based on scope
Custom Scope Review
A tailored engagement for businesses with more complex public-facing environments — multiple domains, public APIs, or specialized reporting needs that don’t fit a standard package.
What’s included
- Multi-domain website review, scoped to your actual asset inventory
- Selected public API endpoint review
- Broader attack surface assessment across all your public-facing properties
- Extended reporting with custom sections (e.g., findings mapped to a framework or questionnaire you name, board-level summary)
- Management summary written for your stakeholders
- Customized remediation guidance based on your internal resources
Who is this for
- Businesses with multiple brands, products, or websites
- Companies with public APIs or integrations that partners depend on
- Firms with specific compliance or reporting requirements (their own or from their clients)
- Any situation where the standard packages don’t quite fit
When a standard package is enough
Most small businesses with one website are well served by a fixed package. Custom scope makes sense when your public footprint is larger or your report has to answer specific questions.
| Your situation | Best fit |
|---|
| One website, you want a quick outside check | Public Website Security Check ($790) |
| One main website with a few subdomains, full external review | External Website Security Review ($1,900) |
| One organisation, focus on leaked data, exposed files and email | Website and Data Exposure Assessment ($3,900) |
| Firm covered by the FTC Safeguards Rule, twice-yearly assessments | Safeguards Rule External Assessment ($2,900/year) |
| Several brands or domains, public APIs, or a report that must answer a client’s or partner’s questions | Custom Scope Review (fixed quote) |
Examples of custom scopes
- A group with several brand websites. Four company sites on different platforms, two forgotten campaign microsites and shared email domains. We review all of them in one engagement and show which issues repeat across the group, so your web team fixes them once.
- A software company with a public API. Partners connect to your API and you want to know what an outsider can learn from it before your next release. We review the public endpoints, error messages, documentation and the websites around them.
- A supplier answering a client’s security questionnaire. A larger client asks for evidence that your internet-facing systems are reviewed. We scope the review around the questions they ask and add a short summary you can attach to your answers.
How scoping works
- You send us the basics by email: your domains, any public APIs or portals, and what the report needs to answer.
- We map your public footprint (subdomains, hosts and services visible from the internet) and reply with a written scope, timeline and one fixed price.
- You approve the scope and we start. Nothing is reviewed outside the agreed list.
- You receive the report with prioritised findings, remediation guidance and a management summary, and you can send follow-up questions by email.
What you’ll receive
- Fully scoped engagement with a written statement of work
- Custom-tailored deliverables based on what matters to your business
- Direct email contact with the reviewer throughout the engagement
- Written executive summary for board and leadership
How long it takes
Timing depends on scope — typically 2–4 weeks from scope confirmation.
What this covers, and what it does not
We cover
- Every domain, subdomain and public API listed in the agreed scope
- TLS, security headers, exposed files, panels and software versions
- Email spoofing protection (SPF, DKIM, DMARC) for each domain
- Findings that repeat across your sites, reported once with all affected places
Not included
- Internal networks, office computers and servers that are not reachable from the internet
- Testing behind logins or with user accounts
- Penetration testing or any attempt to exploit a weakness
- Certification of compliance with any standard or regulation
Common questions
How is the price set?
After you send us your list of domains, APIs and goals, we map your public footprint and reply with a written scope and one fixed price. You approve it before any work starts. There is no hourly billing and the price does not change unless you add to the scope.
Is this a penetration test?
No. We review your internet-facing systems the way an outside attacker would see them, without attacking them or trying to break in. If you need a penetration test, we can tell you which findings deserve one, but it is a separate engagement.
Can you review our public API?
Yes, the parts that are publicly reachable: how endpoints respond to unauthenticated requests, what data and error details they expose, TLS, headers and documentation that is left open. We do not log in or test behind authentication.
Can the report help with a client's security questionnaire?
Often, yes. We can map findings to a framework or questionnaire you name and add a short evidence summary. The report documents what we observed externally on a given date; it is not a certification and does not on its own make you compliant with any standard.
Do we need to give you access or schedule calls?
No. Everything happens by email: scoping, questions, delivery and follow-up. We need no logins, VPN or access to your systems.
Ready to get started?
Custom quote based on scope. Send us your website URL and we’ll confirm scope and timeline.
Request a Quote
Contact Us