Quality Engineering / Security
Understand public exposure, test important access decisions, or establish demonstrated attack impact. Give your engineering team evidence and a practical path to fixes.
Choose the right depth
Surface suits a brochure website. Deep is our main offer for suitable authenticated applications. Choose Adversarial when controlled exploitation and combined impact answer your team's question.
Assessment
€400 + VAT
What does my website expose publicly?
A practical starting point for brochure websites.
Main offer
From €800 + VAT
Do login, permissions and important workflows hold up?
Our main offer for suitable applications with user accounts.
Assessment
From €1,600 + VAT
How far could an attacker actually get?
For teams that need demonstrated exploitation and combined impact.
A workflow is an agreed sequence such as signing in, opening a customer project or changing a user's permissions. We name its operations, roles and expected outcomes; it does not mean every function of your application. We confirm exact scope, access, price and dates before booking. Starting prices do not promise every case within the scope ceiling.
Deliverables
A results discussion and one free focused retest of original findings requested within 30 days of report delivery. We schedule the retest separately. New assets, features and repeated testing need a separate scope.
Explore an Embeddedware example for a fictional application. It illustrates report structure and evidence, not a customer assessment or a promise of findings. The sample is in English.
Optional remediation
Targeted remediation: €70/hour or €400 per booked day, excluding VAT. Agree the work and a spending limit first. A four-hour total allowance is €280, including the investigation, implementation, code review, rollback preparation and regression checks that fit within it. We do not promise to fix every finding.
Booked blocks use the day rate; smaller or ad hoc work uses the hourly rate. The quote defines the working-day duration and charging basis. We never bill the same work twice. Larger changes need an agreed estimate before work begins.
How we work
Testing is limited to owned or owner-authorized assets, an agreed window, permitted effects, stop conditions and cleanup. We confirm access and controlled test data first, then agree delivery dates. Missing access, evidence and untested cases are visible in the report. We make no fixed initial turnaround promise.
Destructive availability tests, persistence, real-data extraction, social engineering and unrelated third-party systems are outside the default offer. Broad network or Active Directory assessments, entire complex multi-tenant platforms, payment-provider systems and embedded or firmware work need specialist scoping. Agreed test tenants and application permission boundaries remain within Deep and Adversarial scope.
Surface is public-only. Deep adds bounded authenticated testing. Adversarial includes explicitly scoped penetration testing and controlled exploitation. No tier is a security certification, exhaustive OWASP coverage, a guarantee of compromise discovery or proof that no vulnerabilities remain.
These website and application services do not automatically cover embedded devices, firmware or your entire product infrastructure. Ordinary defects in our own delivery are not charged again as optional security work. We disclose when assessing our own build; that review is not independent assurance.
Explore Quality EngineeringShare ordinary contact details, the public website URL, package interest and what prompted your enquiry. An enquiry does not authorize testing, confirm eligibility, reserve promotional availability or book an engagement.
Do not send passwords, API keys, vulnerability evidence or sensitive system details through the public form or email. We agree secure access and evidence handling separately.