FR
SOKKAN

← All missions

Your stack, reviewed by someone
who has run a SOC.

The security we sell is not an 80-page PDF. It is a reduced attack surface, secrets that no longer sit in your git history, a CI that blocks regressions and alerts someone actually reads. Every finding comes with the fix applied or a patch ready to merge — not just a line in a risk table.

from CHF 890 · fixed price first findings within 48 h fixed, not merely reported
Tiers & deliverables ↓

Typical use cases

◈Before a raise or a large client

Your enterprise prospect sends a security questionnaire and you have nothing to answer. We close the real gaps and document what already exists.

◈A stack that grew too fast

Forgotten open ports, API keys in git, containers running as root, dependencies never updated — inventory and cleanup.

◈Secrets and access

Rotation, vault, least privilege, MFA where it matters. With the procedure that keeps it true after we leave.

◈Detection & response

Your logs go somewhere but nobody reads them. We build the rules that matter and the runbook for the day it fires.

How it unfolds

  1. Written scope within 24 h: perimeter, what we test, what we don't, and the formal authorisation required.
  2. Reconnaissance: exposed surface, dependencies, secrets, cloud and container configuration.
  3. Findings as they come in the cockpit — no surprise report at the end. Anything critical is flagged immediately.
  4. Remediation: we apply the fixes or ship patches ready to merge, ordered by real severity.
  5. Debrief: prioritised report, what remains, and a handover call. Re-testing of the fixes included.

What we need from you

Tiers & deliverables

Audit

CHF 890
findings within 48 h
  • Attack surface: ports, services, subdomains, TLS, headers
  • Secret hunting across git history and images
  • Vulnerable dependencies and end-of-life versions
  • Report prioritised by real severity + quick wins applied
Order

Hardening · recommended

CHF 1,900
delivered in 5 days
  • Everything in Audit, plus the fixes applied
  • Secret management: vault, rotation, history purge
  • Container and system hardening (non-root, capabilities, network)
  • Security CI: dependency, secret and image scanning that blocks regressions
  • Operations runbook + re-testing of the fixes
Order

Detection & response

CHF 3,500
delivered in 10 days
  • Everything in Hardening, plus detection capability
  • Log centralisation and calibrated alert rules (low noise, real signal)
  • Incident response runbooks: who does what, in which order, with which access
  • Tabletop incident simulation with your team
  • 30 days of support after delivery included
Order

Prices excl. Swiss VAT where applicable · invoiced by Ninabot Sàrl, Geneva · secure Stripe payment · if the scope doesn't fit the tier, we say so at kickoff: reduced scope, higher tier, or refund. At mission end, you choose: ongoing hosting on your instance, or full export + certified destruction of the environment.

Specific to security missions: payment triggers scoping, not testing. No reconnaissance and no testing begins before the signed written authorisation defining the perimeter — we provide the template at kickoff. If scoping reveals that the perimeter is not yours, depends on a third party who does not consent, or exceeds what the tier can seriously cover, you are refunded in full.

Frequently asked questions

Is this a certified penetration test?

No, and we don't claim it is. It is a correction-oriented technical audit run by a SOC / incident-response profile. If you need a formal certified pentest for a regulator, we point you to an accredited firm — and we prepare your stack so they find little.

Do you touch production?

Only with explicit written authorisation and an agreed window. By default we work read-only and on pre-production. Anything that could interrupt a service is cleared with you first.

What if you find something serious?

You are told immediately, before any report, through the emergency channel agreed at scoping. If it is actively exploited, we switch to incident response and re-discuss scope.

What happens to your findings?

They live in your dedicated environment, hosted in Switzerland. Nothing is published, nothing is reused. Full export then certified destruction at the end, if you ask for it.

Not exactly what you need?
Post your mission — fixed-price quote within 24 business hours

SOKKAN