We find the weaknesses in your web applications, fix them with your team, and prove it — in one engagement, from a named practitioner, with our own AI cyber security agents doing the heavy lifting under human sign-off.
A manual, authenticated review of your application or API against OWASP WSTG and ASVS. Our Triage agent clusters and de-duplicates scanner noise so the practitioner spends the hours on what matters.
A remediation sprint with your developers: WAF rules, configuration, code guidance. Warden drafts every WAF exception with scope, expiry and rollback. You keep ownership of production changes.
A retest and an attestation letter formatted for SOC 2 auditors, insurers and customer questionnaires, with evidence delivered into your Vanta or Drata workspace. Scribe drafts; the practitioner signs.
Fixed scopes and published starting prices in CAD. Every paid step includes the fix work and the proof, not just the findings.
Find the weaknesses, fix them with you, prove it to your auditor.
Pass your renewal without surprises.
Fewer false positives, cleaner rules, a decision record for every exception.
Audit-ready evidence for one framework and one business boundary.
Citizen-facing services reviewed, fixed and documented for council.
Someone owns your edge and your exposure every month.
Capacity on call, without a retainer.
Keep your client. Add our depth under your brand.
Get a manual review, the fixes and an auditor-ready letter in three weeks, priced in CAD, from the practitioner you actually meet.
Regulated small businesses and professional servicesOne Ontario city lost $5 million of coverage over incomplete MFA. Here is the evidence pack that answers every question your broker will ask, and the fixes behind it.
Municipal and broader public sectorReviewed, fixed and documented to MFIPPA and O. Reg. 51/26, priced under your invitational threshold, with a summary your council can read.
MSPs and development agenciesNo minimums, monthly billing, co-branded or white-labelled reports, and a conflict screen on every engagement. You are the advisor; we are the execution arm.
We built Scout, Triage, Warden, Scribe, Ledger and Concierge to make a small practice fast and consistent. They reconnoitre, cluster, draft and map. They never exploit, never publish and never attest — every output passes a human gate before it reaches you.
Meet the agentsExternal exposure reconnaissance
Finding clustering and validation support
WAF tuning assistant
Report and attestation drafting
Compliance evidence mapper
Intake and scheduling
No more than 4 concurrent engagements across the team, so the five-day start promise holds. You meet the person who signs your letter.
Findings with reproduction steps and CVSS, a retest record, an attestation letter with framework references, and evidence hashes. Exported to Jira, Vanta or Drata.
Written authorization before any test. No work during an active incident. Round-the-clock response comes from a disclosed partner SOC, never an implied promise. Statement of practice
Scout runs a bounded, read-only External Exposure Snapshot of one domain — free, reviewed by a practitioner before it reaches you.
