Penetration testing: we find the way in first
We attack your website, apps and mail setup the way a real attacker would, with your written permission. You get a report in plain language, concrete fixes and a retest that proves they work.
The first analysis is free · One day of testing from the outside
Why one pentest a year isn't enough
Tested once, exposed the other 364 days
New code, new plugins, new leaks. We scan every month and test in depth every quarter, because attackers don't wait for your annual pentest.
A PDF nobody reads
Every finding ranked by risk, with what it means for your business, proof, and how to fix it. Plus a 30-minute walkthrough.
No proof anything got fixed
A finding is closed when it is proven closed. We retest your fixes and keep watching after.
Every way in, checked
Websites and web apps
We attack your application the way someone else would, and write up every finding with steps to reproduce and a fix.
E-mail setup
SPF, DKIM and DMARC. If someone can send mail in your name, your customers can't tell the difference.
Exposed services and ports
Admin logins reachable from the internet, forgotten subdomains and services that should never have been public.
Weak or leaked credentials
Passwords that are too simple or already circulating, and the doors they open.
Database security
Roles, grants, row-level security, encryption at rest, and backups that have actually been restored.
Cloud and infrastructure
Hosting, secrets, CI/CD and third-party access. We look for the forgotten key and the door nobody closed.
Start free. Stay protected.
Free security analysis: €0
One day of testing from the outside: website, domains, mail setup and exposed services. A risk report in plain language and a 30-minute walkthrough. No strings.
Read more →Security plan: €99 a month, or €790 a year
A deep scan every quarter reviewed by a person, an automated scan every month in between, an alert when something critical shows up, and fix proposals. Prices excl. VAT.
Read more →Fixing what we find
Want us to close the holes as well? Every fix gets its own fixed price, agreed before we start.
Read more →
How the free analysis works
Four steps, with your permission on paper before anyone touches a system.
- 01
Permission in writing
You tell us which domains to look at. We confirm the scope, the time window and what's off-limits in writing.
- 02
One day of testing
We test from the outside the way an attacker would, and log everything we do.
- 03
A report in plain language
Every finding ranked by risk, with a summary for the owner, proof for each finding and a fix for each finding.
- 04
Walkthrough and plan
A 30-minute call to go through it together. The analysis is yours to keep, whether you continue with us or not.
What people ask us
What does a penetration test cost?
The first analysis is free: one day of testing from the outside. To keep testing, the Security plan costs €99 a month, or €790 a year (about €66 a month), excl. VAT, with a deep test every quarter. Need one application tested in more depth? We quote that up front.
What's the difference between a vulnerability scan and a pentest?
A scan is automated and looks for what's already known. In a pentest, a person tries to get in the way an attacker would, and combines small weaknesses into a real way in. We do both: automated scans every month, and every quarter a deep test reviewed by a person.
Is it legal to have my company hacked like this?
Yes, with permission, and we only test with your written permission. Before anyone starts, we confirm the domains, the time window, the contacts and what's off-limits.
Can the test take my website down?
We agree the time window and what's off-limits up front, and log everything we do. If something on your side is fragile, tell us and we leave it out or plan around it.
Do I need a pentest for NIS2?
NIS2 doesn't prescribe one specific test for every company, but companies it covers have to manage their risks and check that their measures work, and a pentest is a common way to show that. Whether NIS2 applies to you is something to check with the Centre for Cybersecurity Belgium. We give you the findings and the proof of what got fixed.
Do you also fix what you find?
If you want us to. Every fix gets its own fixed price, agreed before we start, and we retest it afterwards. Your own developers can also use the report: each finding comes with a fix.
Also from Sidestream
Find out what's actually exposed
The first analysis is free: one day of testing, a report in plain language and a walkthrough. If there's nothing worth fixing, we'll say so.