Cybersecurity services in Harare: from testing an app to getting an account back.
Ten ways to find, fix and defend against the things that actually put a business at risk. Every engagement is scoped, authorised in writing, and done by hand.
- Authorised
- in writing, fixed scope
- Manual
- founder-led, by hand
- Reported
- ranked, with fixes
Attack surface explainer
Every part of a business can be a way in. Here is how each one is assessed.
Choose a part of your business to see the common categories of risk, what an authorised assessment looks at, and what happens from report to retest. This is an overview for decision makers, not a how-to.
Public website
The first thing anyone can look at, without a login, from anywhere in the world.
Common categories of risk
- Missing or weak HTTPS and security headers
- Outdated plugins, themes or content management software
- Forgotten pages, test copies and subdomains still online
- Version numbers and error messages that say too much
What an authorised assessment examines
- Certificates, HTTPS redirects and the security headers the site sends
- Software versions against known, published weaknesses
- What the site reveals publicly about how it is built
- Contact forms and anything else that accepts input
What the report contains
- A plain summary of the site's overall exposure
- Each finding with its severity and the evidence behind it
- A specific fix for each item, written for whoever runs the site
How findings are prioritised
- Severity first: Critical, High, Medium or Low
- Then business impact: a weakness on the page that takes payments outranks one on a brochure page
- Quick wins, such as a missing header, are flagged so they are not left waiting
Remediation and the retest
- Your developer or host applies the fixes, with us available for questions
- Many fixes are configuration changes rather than rebuilds
- Serious findings are checked again to confirm they are actually closed
A small guest lodge with a booking enquiry page
- Finding:
- An old copy of the site left on a test subdomain, running unpatched software
- Severity:
- High
- After the fix:
- The copy was taken offline and the subdomain removed. The retest confirmed it no longer answers.
Testing only ever happens with written authorisation from the owner of the systems and an agreed scope. Testing systems you do not own or have permission to test is illegal. No assessment can prove a system is secure; it shows what was found, in scope, at the time.
Three levels of assurance
A free check, an audit and a penetration test are not the same thing.
Each one sees more than the last. Start with the free check if you are unsure, and use the price estimator to scope a test.
Level 1
Automated check
Free
Our public, passive scan of your website. A useful first look, not an assessment.
- Scope
- Your public website only
- HTTPS, certificates, security headers and redirects
- Email records such as SPF and DMARC in the PDF report
- Authorisation
None needed. It only reads public information: it never logs in, scans ports or attempts to exploit anything.
- What you get
- A grade on screen
- An optional five page PDF report with plain fixes
- Limitations
- It cannot see behind a login, into an API or inside your network
- It cannot test access control or business logic
- A good grade is not proof that a site is safe from attack
- Timing
Results in seconds
Level 2
Security audit
From $500
A full vulnerability assessment of your website, with fixes ranked by priority.
- Scope
- A structured scan and review of your public facing systems
- Configuration, software versions and known weaknesses
- Every finding ranked by business risk
- Authorisation
A written scope and your signed authorisation before any testing starts.
- What you get
- A written report with findings ranked by priority
- A specific fix for each finding
- Limitations
- Breadth rather than depth: it does not include the hands-on exploitation of a penetration test
- Business logic and access control between users are not tested in depth
Level 3
Manual penetration test
From $1,200
Manual testing of web apps, APIs and networks, a written report and a retest.
- Scope
- Web applications, APIs, staff email and admin accounts, external network
- Internal network, Wi-Fi and phishing simulation on request
- Exactly what your written scope names, and nothing else
- Authorisation
A signed authorisation naming what may be tested and when, a contact reachable during testing, and test accounts if logged-in areas are in scope.
- What you get
- An executive summary and every finding rated Critical, High, Medium or Low
- Proof for each finding and developer-ready fix steps
- Same-day notice of critical findings, and a retest after you fix
- Limitations
- It covers what is in scope, as it stood when tested
- It reduces risk; it is not a guarantee that nothing else exists
- Timing
Report within 3 working days of testing ending
Mobile app security testing
Your iOS and Android apps tested end to end, the way a real attacker works: what the app stores on the device, how it talks to your backend, and everything it exposes along the way.
- Static and runtime analysis against the OWASP mobile standard
- Local storage, keychain and keystore, and live traffic inspection
- The API behind the app, where most of the real findings sit
- A plain report, ranked by risk, with a fix for every item
Offensive testing
Find the gaps before someone else does.
We attack your own systems with your written authorisation and a fixed scope, then hand you a plain report with every finding and exactly how to close it.
Response and recovery
When something has already gone wrong.
A breach or a locked account is not the time to start reading documentation. These are the services you call on when the clock is running.
People and posture
Security that holds up every day.
Most incidents start with a person or a design decision, not a zero day. These services raise the floor across your whole team and your whole stack.
More security services
Each one explained in full.
How an engagement runs
No surprises, no grey areas.
- 1
Scope
We agree exactly what is in and out, in writing, before anything begins.
- 2
Test
Hands-on work by one accountable engineer, not a scanner with a logo.
- 3
Report
Plain findings, ranked by risk, each with a concrete fix to apply.
- 4
Retest
We check the serious findings again until every one is closed.
Not sure which of the ten you need? Tell us what you are protecting and we will point you to the right one.
Tell us what you need protectedQuestions, answered
- Which security service do I need?
- Start from what you are protecting. A website or web app usually needs a website security audit or a penetration test, a team that keeps getting phished needs awareness training, and a hijacked page needs account recovery. Tell us what you run and we will point you to one service, not all ten.
- Do you test systems without permission?
- Never. Every engagement starts with written authorisation from the owner, naming exactly what may be tested and when. We only test systems you own or are allowed to authorise.
- Who does the work?
- The founder, Donovan Mudarikwa, does the hands-on work personally, and holds CompTIA PenTest+ and CompTIA Security+.
- Are our findings kept confidential?
- Yes. Findings go only to the contacts you name. Case studies describe outcomes only, never a client's findings.
- How much does it cost?
- A website security audit starts at $500 and a manual penetration test at $1,200. You get one fixed, written quote before any work starts, and a 50% commitment fee secures the booking.
- What happens after the report?
- You fix the findings, with our guidance if you want it, and we retest the serious ones until each is closed.
Not sure where to start?
Two free ways in. Neither one commits you to anything, and both tell you something useful today.
Check your website first
Enter your domain for a plain-English snapshot of what anyone can already see about it.
Or open the full security checkTalk it through with us
A free 30 minute call about what you need. You leave knowing which service fits, what it costs to start, and what happens next.
Book a free 30 minute call