03security
03.1scope
MOD-03
Cybersecurity
Basics
A 12-point audit for small sites and applications. Not penetration testing — the fundamentals that account for most real incidents at this size, ranked by severity so you can triage honestly.
FIG. 03 — exploded security layer diagram
03.2self-assessment
Tick what you already have. The score is weighted by severity — this is the same sheet we work from on a paid audit.
0
Not assessed0 / 0 pts
Tick the controls you have in place.
03.3engagement
How an audit runs
| Stage | Duration | Output |
|---|---|---|
| Recon | 1 day | Surface map, tech fingerprint |
| Automated scan | 1 day | Headers, deps, TLS, DNS |
| Manual review | 2 days | Auth flows, uploads, admin routes |
| Report | 1 day | Ranked findings + fix estimates |
Five working days total. Fixes are quoted separately so you can do them yourself if you prefer.
Out of scope
We are deliberately narrow. These need a specialist and we will refer you rather than pretend:
- Full penetration testing
- Compliance certification (SOC 2, ISO 27001)
- Incident response during an active breach
- Infrastructure hardening at scale