RUEN
Discuss a project

Cybersecurity

We test the security of websites and infrastructure, fix vulnerabilities and build up your defences. We start with a free passive audit.

  • Freepassive audit

    We look at what anyone can see about your company from outside, without access to your systems.

  • from $500basic vulnerability fixes

    Active audits and fixes start once we have a contract.

  • Anywherelocation

    We work remotely and sign an NDA before any active work.

Why protect yourself in advance

There is less security every day. AI tools now find vulnerabilities faster than people do, and they are used not only by researchers but by attackers too. New holes turn up everywhere: in programming languages such as PHP, in routers and game consoles, in banking systems.

Finding a weak spot used to take weeks of manual work, so attackers mostly went after large companies. Now scanning and code analysis are automated, and an outdated plugin, a forgotten test service or a password nobody has changed in years gets found at a company of any size.

That is why security is not a reaction to a breach. It is regular testing and fixing vulnerabilities before someone else finds them.

Two ways to work

  • Quick check and protection

    A website, an online store or a small company

    Time
    from a couple of days
    Cost
    from $500
    • A free passive audit: what can be seen about the company from outside
    • A website check: CMS, plugins, forms, admin access, server settings, HTTPS and security headers
    • Protecting your email and domain from spoofing: SPF, DKIM, DMARC
    • Updates, fixes for the vulnerabilities found, backups
    • A short report: what we found, what we fixed and what to do next

  • Company security assessment

    A company with offices, cloud services, its own servers and contractors

    Format
    Security Assessment
    Cost
    after the free audit
    • Analysis of IT infrastructure, cloud services and the technologies in use
    • Review of access management, accounts and privileges
    • Analysis of monitoring, threat detection and incident response
    • Review of security tools and how effectively they are used
    • Finding architectural weaknesses and possible attack scenarios
    • Assessment of how mature your information security processes are

What we do

  • Website security audit

    We check the CMS, plugins, forms, admin panel, hosting and server settings, fix what we find and update whatever is outdated.

  • Penetration testing

    Pentests of websites, apps and infrastructure: within agreed limits we act like an attacker and show where one could really get in.

  • Company security assessment

    Infrastructure, cloud, access, monitoring and processes. The outcome is a list of risks by severity and an action plan.

  • Email and domain protection

    We set up SPF, DKIM and DMARC so nobody can send phishing emails in your company’s name.

  • Staff training

    Practice phishing campaigns and short, clear rules: most attacks start with an email or a message.

  • Backups and an incident plan

    We make sure your data can be restored and agree in advance who does what if an incident happens.

  • Safe use of AI

    We define which data may go to AI services and set up access and rules for your staff.

  • Incident response

    We work out how the attack happened, close the entry point and help you get back to work without a repeat.

How a security assessment works

  1. 01

    We analyse your infrastructure

    • Cloud services: AWS, Azure, GCP
    • External services and integrations: GitHub, Slack, Office
    • Servers and data centres
    • Network devices
    • Workstations
    • Accounts and access
    • Users and roles
    • Applications and services
  2. 02

    We run a full assessment

    • Infrastructure and cloud
    • Access and privileges
    • Monitoring and response
    • Security tools
    • Architecture and attack scenarios
    • Process maturity
  3. 03

    We give you clear results

    Sample report

    Risks by severity20 risks

    • Critical3
    • High5
    • Medium8
    • Low4

    Security improvement roadmap

    1. 0–3 moUrgent fixes
    2. 3–6 moStronger defences
    3. 6–12 moMature processes

What clients come with

  • Your website has been hacked or behaves oddly: strange pages, redirects, spam
  • You want to know how secure your company is before attackers find out
  • Fraudulent emails are being sent from your domain
  • The site hasn’t been updated for a long time: an old CMS and plugins, forgotten contractor accounts
  • A client, a partner or an audit asks you to confirm your level of security
  • Staff use AI services and it’s unclear what data ends up there
  • The company has grown, with cloud services, branches and contractors, but access rules haven’t changed

What you get

  • A report on your current level of security that makes sense to both management and the IT team
  • A list of vulnerabilities and risks, each rated by severity
  • Fixes for critical vulnerabilities, by us or together with your team
  • Practical recommendations: what to do, in what order and how much effort it takes
  • A prioritised plan to improve security over 3, 6 and 12 months (Security Improvement Roadmap)

The passive audit is free. Active audits and fixes start after we sign a contract and an NDA. We work with companies in any country.

Discuss your task

How we start

  1. 01. Free passive audit

    We look at the company the way an attacker would: website, domains, email, exposed services, leaks. No access to your systems and no interference with them.

  2. 02. Contract and NDA

    We fix the scope, timing, cost and rules of engagement. Everything we learn about your infrastructure stays confidential.

  3. 03. Active audit

    We test vulnerabilities in practice: penetration testing, configurations, access and processes, within agreed limits and at a convenient time.

  4. 04. Fixes and a plan

    We close critical vulnerabilities and hand over a report and a 3-, 6- and 12-month plan. After that we can test your security regularly.

Case studies

All work

We don’t disclose company names or infrastructure details: all security projects are under NDA.

  1. CybersecurityUnder NDA

    Domain takeover

    How a forgotten internal web service gave attackers a way into every enterprise in a corporation

    We reconstructed the attack chain, from the outdated web service to domain control, and identified where defences failed. We handed over recommendations for the measures that close this scenario.

    View case: Domain takeover

  2. CybersecurityUnder NDA

    Phishing email

    How a single phishing email ended with the corporate database being stolen

    We reconstructed the attack chain, from an employee’s email to the stolen database, and identified where defences failed. We handed over recommendations on email, workstations, admin accounts and outbound traffic.

    View case: Phishing email

  3. CybersecurityUnder NDA

    Exposed segment

    How a router misconfiguration exposed a company’s internal network to the internet

    We found the misconfiguration that exposed the internal segment to the internet, reconstructed the attack and identified where defences failed. We handed over recommendations on network settings, updates and segmentation.

    View case: Exposed segment

FAQ

What is a passive audit and why is it free?

It is a check based on public information: your website, domains, email settings, services reachable from the internet and known leaks. It needs no access to your systems and doesn’t affect them in any way. We do it for free so you can see straight away whether there is cause for concern.

How is an active audit different?

An active audit runs under a contract and with your permission: we test vulnerabilities in practice, run penetration tests and review configurations, access and processes from the inside. That is how we find problems that can’t be seen from outside.

How much does it cost?

The passive audit is free. Basic vulnerability fixes start at $500. The cost of a company security assessment depends on the size of the infrastructure; we quote it after the free audit.

How long does it take?

Checking and protecting a small company’s website usually takes a couple of days. The length of a company security assessment depends on the size of the infrastructure, and we agree it before we start.

Will the testing disrupt our website or staff?

The passive audit doesn’t touch your systems. Active tests run at an agreed time and within agreed limits, and anything that could affect your services is agreed in advance.

Do you only work with large companies?

No. We can quickly check and protect a small business website, or run a full security assessment for a company with branches and its own infrastructure.

Do you work with companies in other countries?

Yes, anywhere: we work remotely, in English or Russian.

How do you keep things confidential?

We sign an NDA before any active work. We don’t disclose client names or infrastructure details, which is why the case studies on this site are anonymised.

Other services

What shall we build together?

Tell us what you want to launch or improve. We’ll discuss the task and suggest the next step.

Discuss a project gayk@blueberryagency.ru