01 / ASSESSMENT
Findings Report
Executive summary, findings by severity, evidence captures, remediation steps. Modeled on the structure established pen testing firms use. PDF, ready to forward to your team.
View sampleAutomated assessment at $1,999/yr. Real human pen test at $4,999 flat. SOC 2 readiness in 90 days from $5,999. Every deliverable says exactly what we did — and what we didn't. So your auditor, prospect, and procurement team all get the same straight answer.
An automated scan when that's what you need. A real pen test when that's what you need. SOC 2 readiness when the audit deadline is what you need. We're explicit about which is which — and we charge accordingly.
Toolchain-based scan against your application. Headers, TLS, known CVEs, exposed surfaces. Annual artifact for vendor questionnaires.
Automated + 1 pen test + 1 retest per year. Predictable monthly, save vs à la carte.
Senior engineer + engine probe for IDOR, business logic, auth bypass, chained exploits. Sequential-ID fuzzing, user-enum probing, narrative report with Burp-style evidence, signed Remediation Report after retest.
Independent industry data on the vulnerability and breach landscape. These are the facts your customers and auditors are already reading.
Executive summary, findings by severity, evidence captures, remediation steps. Modeled on the structure established pen testing firms use. PDF, ready to forward to your team.
View sampleOne-page PDF you can share with prospects. Public verification URL with QR code. Scope and methodology stated honestly so nobody is misled.
View sampleAfter you fix the findings, request a re-scan. Get a follow-up report showing what's now clean. Included in every plan, no surcharge.
Learn moreA clear table of what automated scanning can — and can't — detect. Use it to decide what level of testing you actually need.
| Vulnerability class | CyberGrid finds it | Needs manual pen test |
|---|---|---|
Missing security headers CSP, HSTS, X-Frame-Options, cookie flags |
✓ Yes | — optional |
TLS / cipher misconfiguration Weak ciphers, expired certs, deprecated protocols |
✓ Yes | — optional |
Exposed admin panels & secrets .env files, .git folders, debug endpoints |
✓ Yes | — optional |
Known CVEs in your stack Outdated libraries, vulnerable plugins, dependency CVEs |
✓ Yes | — optional |
Verbose error / stack trace disclosure Information leakage in error responses |
✓ Yes | — optional |
IDOR / broken access control User A reading User B's data |
✗ No | ! Required |
Business logic flaws Coupon abuse, race conditions, workflow bypasses |
✗ No | ! Required |
Authenticated session attacks Privilege escalation, complex auth bypasses |
✗ No | ! Required |
Same scope can come back at $2,999 from a boutique and $45,000 from a Big-4. Use our calculator: tell it your app type, scope, and compliance driver, see the real industry range — and where our $4,999 flat fee fits.
Every report lists each tool used by name and version. No black-box claims. If a customer asks "what did you actually run?", we have a clear answer.
Detects exposed paths, known CVEs, common misconfigurations, header issues, and information disclosure across your application's public surface.
Cipher suites, certificate chain, protocol versions, HSTS configuration, and known TLS vulnerabilities. Catches deprecated protocols still enabled.
Subdomain enumeration, exposed services, port-level fingerprinting. Identifies forgotten endpoints, shadow infrastructure, and orphaned hosts.
Findings normalized to a common severity scale (Critical / High / Medium / Low / Informational). PDF report with evidence, remediation, and a verifiable attestation page.
Add a DNS TXT record we generate. Confirms you own what we're about to scan.
~5 minutesPick an immediate or off-hours window. We respect your traffic and rate-limit.
instantOur worker runs the toolchain against your target. Live progress in your dashboard.
30–90 minutesPDF report in your inbox. Attestation with verification URL ready to share.
within 24 hoursA realistic findings report for a fictional SaaS — same structure customers receive. See severity ratings, evidence captures, and remediation language.
Open sample reportThe one-page verifiable artifact you'd hand to a prospect. Public verification URL with the QR code and an honest statement of scope.
Open sample attestationWe were six months in, a $50k ARR contract on the line, and the buyer asked for a security testing artifact. CyberGrid had a real attestation in our prospect's inbox the next morning. Closed the deal.
The honest framing is the whole reason we picked them. I'm not going to pretend a $1,999 scan is a pen test, and my customers respect that I don't. Other vendors made me uncomfortable with what they were claiming.
Caught a misconfigured S3 CORS policy and a stack trace leak our team missed for a year. Two real findings on the first scan. Both fixed before the report PDF generated.
SOC 2 auditor asked for our most recent pen test on a Tuesday. We had a kickoff call Wednesday, scoped Thursday, and the engagement was running Monday. Report a week later. The compliance-mapping appendix dropped straight into our auditor's evidence file.
Found a real IDOR in our billing endpoint — cross-tenant data access — that our own QA had missed for eighteen months. PoC was reproducible in five steps. Patched same-day. Worth the $4,999 a hundred times over.
The procurement package — NDA, MSA, DPA, SoW, pre-filled security questionnaire — saved us literal weeks. Our legal team signed the templates as-is. First time that's happened with a vendor.
SOC 2 readiness in eight weeks instead of six months. They scoped exactly what we needed, did the gap analysis, ran the pen test, and handed our auditor a binder. The CPA they referred us to closed Type I without a single follow-up question.
Continuous caught a regression three days after we shipped a new auth flow — an unauthenticated endpoint exposed by a stale rewrite rule. We'd never have found it before our next annual pen test. Worth $999 a month on that incident alone.
Did our iOS + Android pen test for one fixed price. Found a hardcoded API token in the Android binary and a TLS pinning bypass via Frida. Both report-ready, both reproducible. We patched and shipped in the same sprint.
Quarterly scans + public attestation. The right floor for any team that needs an audit-ready artifact.
Automated + 1 senior-engineer pen test + 1 retest annually. Predictable monthly cost.
One-off pen test. A senior engineer, manually, methodology-based. The real thing.
Our SOC 2 readiness service is a full 90-day program: policy library, control implementation, evidence collection, GRC tooling setup, and a referred CPA audit firm to issue your Type I report. Bundle with the pen test below for a complete compliance posture.
The $1,999 automated assessment isn't one, and we'd never call it one — it runs scanners (nuclei, httpx, testssl.sh) and finds a defined subset of issues. We also offer a separate penetration testing service ($4,999 flat) for the things scanners genuinely can't find: IDORs, business logic, authentication bypass, chained exploits. See /penetration-testing. Both are useful, clearly labeled, and we never call one the other.
For some auditors and some risk classifications, an automated assessment is acceptable. For others — especially anything customer-data-adjacent — you'll need a real pen test. We don't promise SOC 2 acceptance because that decision is between you and your auditor. We do give you a clear, documented artifact you can show them.
We email you immediately — we don't wait for the report. You get the finding details, remediation steps, and free re-scans until it's fixed. We never publish or share findings; they're yours alone.
Our default profile is non-destructive — no fuzzing of inputs that could cause data corruption, no DoS-style traffic spikes. We rate-limit to 50 requests per second and you can schedule scans for off-hours. That said, any active scanning carries some risk of triggering rate limiters, WAFs, or unusual error paths, which is why our Service Agreement includes the same disclaimer every reputable scanner uses.
Those are continuous monitoring products at $150–300/month. CyberGrid is quarterly point-in-time at $1,999/year — flat, no tiers. Better fit if you want clean dated artifacts and a real pen-test option from the same vendor; worse fit if you want continuous monitoring. We're also more direct about scope limitations — we publish a public "what we catch / what we miss" table on the homepage, which the bigger players don't do.
Yes. Every attestation has a public verification URL anyone can visit to confirm it's real, see what scope was tested, and read the methodology. The verification page is plain about what was and wasn't included — that protects everyone involved.
Cancel anytime from your dashboard. Plans don't auto-renew unless you choose. If you cancel mid-year, you keep access to your reports and attestations indefinitely — they're yours.
Get your application assessed, your report in 24 hours, and an attestation you can hand to anyone asking about your security posture.