We assess website security through manual testing and scanners against OWASP Top 10 and CIS Top 18. You receive a CVSS-rated report, fix plan and re-audit after 30 days included in the price.
Four things you always get with a Balance IT security audit package.
Current website assessment + penetration test scope → quote within 24h.
Burp Suite + OWASP ZAP + Nessus as a baseline, manual penetration testing for business logic + edge cases.
Every vulnerability CVSS-rated with severity (CRITICAL/HIGH/MEDIUM/LOW) + a fix plan by priority.
After fixes are implemented: a re-audit verifying that vulnerabilities have been closed. Included in the package price.
Automated scan = baseline (30-40% coverage). Manual penetration test = business logic + edge cases + additional manual tests. All with a CVSS-rated report + roadmap.
Recon + automated scan (Burp / OWASP ZAP / Nessus / Nuclei)
Manual penetration test (logged-in + unauthenticated + business logic + injection vectors)
CVSS-rated report + roadmap (CRITICAL → HIGH → MEDIUM → LOW)
Automated scan + nuclei templates. 30-40% coverage.
Logged-in + unauthenticated + business logic + edge cases. The remaining 60-70%.
Every vulnerability with a CVSS score + exploit difficulty + recommended fix.
After fixes are implemented: verification included in the package price.
Choose the scope — always with a CVSS-rated report and re-audit after 30 days. Net prices. The amounts shown cover the package scope; additional work requires an agreed scope and confirmed quote.
Delivery 5-7 days
Delivery in 1-2 weeks
Delivery in 3-4 weeks
Automated scan + manual penetration test + OWASP / CIS + CVSS-rated report. No "scanner for 99 zł and we disappear".
Subdomain enumeration + port scan + tech fingerprinting + nuclei templates for known CVEs. Baseline + entry point list.
Manual penetration test: auth bypass, IDOR, SQL injection, XSS (stored/reflected/DOM), CSRF, SSRF, business logic flaws.
Full OWASP Top 10 2021 coverage: A01 Broken Access Control → A10 Server-Side Request Forgery.
.htaccess + php.ini + nginx config + WP-CLI doctor + security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options).
CIS Top 18 controls audit + PCI-DSS gap analysis (where the client handles payments) + ISO 27001 gap analysis (where compliance is required).
Report: per vulnerability — CVSS score, exploit difficulty, recommended fix, effort estimate. Priority roadmap + schedule.
We review these questions with you before we confirm the scope and deliverables.
Scope and handover
Which systems, scenarios and people are in scope?
What access and materials do we need before starting?
How will we judge whether the audit or training is useful?
Who will act on the findings and check the result?
The Balance IT standard
Burp + ZAP + Nessus as a baseline + manual penetration testing of business logic.
Every vulnerability with a CVSS score + exploit difficulty + recommended fix.
Fix plan by severity (CRITICAL → LOW) + effort estimate per vulnerability.
After fixes are implemented: verification included in the package price. Is the vulnerability actually closed, and have any new ones been introduced?
CVSS
rated report
30 days
re-audit included in the price
24h
quote
Four things that set us apart from a "scanner for 99 zł and a 1-screen report". Each measurable and confirmed in the package.
Every stage ends with a demo and approval. Re-audit after 30 days — included in the package price.
Days 1-2 · baseline
Days 3-5 · deep dive
Days 6-7 · production
Week 4+ · post-audit
Loading projects...
Answers to frequently asked questions about Cybersecurity