Cyber security services
that end with a retest,
not a report.

Cost tracks scope and depth rather than a per-asset rate. A single web application tested grey box sits in a very different bracket to a full infrastructure, cloud and mobile assessment run white box with a compliance deliverable attached. We quote a fixed figure against a written scope, and the retest is included rather than billed as a second engagement.

A scan is automated pattern matching: fast, cheap, and useful for catching known issues and missing patches. A penetration test is a person attempting to actually exploit what they find, chain it with other weaknesses and reach something that matters. Scanners cannot find broken access control, business logic flaws or privilege escalation paths, which is where the serious findings usually are. Be wary of any quote where the deliverable is a scanner export with a cover page.

About six weeks for a full cycle. That is one week of scoping and authorisation, one week of reconnaissance, and two weeks of manual testing. Reporting and remediation support take a week, with a final week to retest once your fixes are deployed. The testing window itself varies with depth — black box is typically one to two weeks, white box three to four.

Not without your explicit agreement. Testing windows, rate limits and out-of-scope systems are agreed in the rules of engagement before anything starts, and anything genuinely destructive is either excluded or run against a staging replica. We keep an escalation contact live throughout, so if something behaves unexpectedly, testing stops immediately.

We help fix them. The report includes developer-facing guidance describing the specific change needed, not a generic description of the vulnerability class. We also run a working session with your engineers to walk through the findings. Where you would rather we implement the fixes ourselves, we can — and every finding is retested before the engagement closes either way.

Yes. We run a gap assessment against the standard, implement the missing controls with your team, and establish the evidence trail those controls generate. We then prepare you for the external auditor, who must be an independent certification body rather than us. Most clients on a normal starting position need somewhere between three and six months, driven mainly by how much evidence history the auditor expects to see.

The Digital Personal Data Protection Act 2023 sets five main obligations. You need clear notice and consent for personal data processing, and you must honour data principal rights including correction and erasure. You also need named responsible contacts, reasonable security safeguards, and breach reporting to both the Data Protection Board and the affected individuals. In practice it means knowing what personal data you hold and where, which is where most organisations discover the real gap. We map that, then build the consent, rights-handling and breach processes around it.

Contact us and we will help with containment first: isolating affected systems and preserving logs before they rotate away. The next job is establishing what was actually accessed rather than what was feared. From there we support forensic analysis, recovery, regulatory notification within the applicable windows including CERT-In's six-hour requirement, and the post-incident work to close the path that was used.

You can check before you call us. Run asematic.com through any public header scanner and you will find HSTS with a two-year max-age, includeSubDomains and preload; a Content-Security-Policy denying framing; X-Frame-Options set to DENY; nosniff; a strict referrer policy; and a Permissions-Policy switching off camera, microphone, geolocation and interest-cohort. It is a small thing to check and a fair proxy for whether a security supplier practises what it sells.