Find the weak points before someone else does.
Security audits, hardening and monitoring for business websites and web applications. You get the findings in plain language, a prioritized fix list, and help fixing them.
- HighAdmin accounts without two-factor loginProtect: identity and access
- HighPlugin with a known, patched vulnerabilityIdentify: vulnerability management
- MediumBackups never tested with a restoreRecover: recovery planning
- MediumMissing security headersProtect: platform security
- LowServer software version visibleProtect: platform security
Retest after fixes: included
Think your site has been hacked? Don’t delete anything yet.
Email security@aegisfuse.com or call [phone number].
Best for
Businesses with a website, store or portal that handles customer data
Audit timeline
[X] business days
Engagement
Fixed-price audit, then a project or a care plan
Starts with
An audit, or a call if you think you’ve been hacked
When it’s time for a security review
Nobody can say when the site’s plugins were last updated.
Former staff or agencies may still have admin accounts.
Your cyber insurance form asks about MFA, backups and patching, and you’re not sure what to answer.
You were hacked before and never found out how they got in.
Three ways we help
Security audit
Accounts, hosting, application, plugins and data handling reviewed against the NIST Cybersecurity Framework 2.0 and the OWASP Top 10.
Fixed price, with a free retest after fixes.
Hardening and cleanup
We fix what the audit found: updates, configuration, access, headers and backups. After a hack, we clean up, find the root cause and write a timeline.
Fixed price per scope.
Monitoring and care
Monthly updates, uptime and file-change monitoring, tested backups and a monthly report.
We respond within [X] business hours.
What’s in the audit report
Written for two readers: the person who signs off on the budget and the person who fixes the problems.
Executive summary
Your risk in plain language, for owners and managers.
Findings
Each one with severity, evidence and the steps to reproduce it.
Prioritized fix list
Ordered by risk and effort, with who should do each fix.
Framework mapping
Every finding mapped to a NIST CSF 2.0 function, for your records or your auditor.
Insurance checklist
Answers to common cyber insurance questions, based on what we verified.
Retest
After you fix the findings, we check again and update the report.
How an audit works
Scope and authorization
We agree in writing what we’ll review and when. Nothing is tested without your signed authorization.
From you: a signed authorization and, where possible, a staging copy.
Review
Automated scans plus a manual review of configuration, accounts, plugins and code.
From you: temporary accounts we remove at the end.
Report and walkthrough
A call to go through the findings and decide what to fix first.
From you: the people who will make the decisions.
Fix and retest
You fix the issues, or we do. Then we retest and update the report.
From you: a note when the fixes are in place.
Straight answers for your IT and legal team
What we test, what we don’t, and how we handle what we find.
Authorization
We only test systems you own or are authorized to test, under a signed scope with dates and contacts.
Audit, not a penetration test
An audit reviews configuration, accounts, code and processes. If you need a penetration test for compliance, we scope it separately or refer you to a firm that specializes in it.
Confidentiality
Findings go only to the contacts you name, through an encrypted channel, and our working copies are deleted [X] days after the engagement.
No guarantees we can’t keep
No one can promise a system will never be breached. We reduce the risk, make attacks easier to spot and make sure you can recover.
Questions about security work
Is a security audit the same as a penetration test?
No. An audit reviews configuration, accounts, code and processes, with automated scanning. A penetration test simulates an attack against agreed targets. We’ll tell you which one you need.
We think we’ve been hacked. What should we do?
Don’t delete anything yet. Email security@aegisfuse.com or call us: we’ll help you contain it, keep the evidence and clean up.
Can you help with our cyber insurance application?
Yes. The audit includes answers to common questions about MFA, backups and patching, based on what we actually verified.
Do you work on sites you didn’t build?
Yes. Most audits are on sites built by someone else, and that’s often when they’re most useful.
Know where you stand.
Book a fixed-price audit. You keep the report whether or not we do the fixes.