Pillar D — Defensive Cybersecurity
The problem: outdated plugins, reused passwords, no two-factor authentication, admin panels exposed to the whole internet, and backups that were never tested. Attackers automate the search for exactly these basics. Fixing them is unglamorous — and it removes the majority of your real-world risk.
| Authorisation | Every assessment requires explicit written authorisation from the system owner, with scope, targets, testing window, permitted techniques, exclusions, and an emergency contact defined before any work starts. |
|---|---|
| Your systems only | We work only on infrastructure you own or are explicitly authorised to have assessed. No third-party targets, ever. |
| What we never do | No unauthorised scanning or exploitation, no persistence, no data extraction, no destructive testing, and no disruption of your live services. |
| Honest limits | We do not offer 24/7 monitoring or incident response, we claim no security certifications, and no service can guarantee security. A bounded configuration review is not a penetration test. |
| Penetration testing | Not currently offered. If your need is a formal penetration test, you need an established, certified provider — we will say so plainly rather than sell you a substitute under a bigger name. |
Businesses that run a website or small server and have never had its basic security posture reviewed — especially before a launch, after a redesign, or when moving to a new provider.
Signed authorisation and scope document: targets, checks, window, exclusions, emergency contact.
Checklist-based review of the agreed asset, within the agreed window only.
Findings with evidence, impact, severity, and concrete remediation steps — plus the limitations of the review itself.
One bounded re-check after your remediation, within the included hours.
The engagement format is public: a sample report excerpt, a second sample covering headers and transport security, and the full baseline checklist — plus our plain-language guide to what a security baseline includes.
The OWASP Top 10 is the industry's standard awareness list of the most critical web application security risks. Below is the full 2021 list, each item mapped honestly against what our defensive baseline actually covers — including the three that sit entirely outside it. The baseline is a configuration and hygiene review, not a penetration test, and nothing on this page is a guarantee of protection.
Users reach pages, files, or actions they should not be able to reach.
Baseline: Account and admin-access hygiene: platform-level access settings, admin paths, and who holds which account are reviewed. Application-level access logic is code — and code review is outside the baseline.
Sensitive data is exposed because it is unencrypted, weakly encrypted, or sent over insecure connections.
Baseline: Transport configuration only: HTTPS enforcement and TLS settings are checked. How an application encrypts its stored data is outside the baseline.
Attacker input is executed as commands or database queries, letting attackers read or alter data.
Baseline: Not covered. Detecting injection requires code review or active security testing — both outside the baseline.
The design itself lacks the controls a secure system needs, before any code is written.
Baseline: Not covered. Application design review is outside the baseline.
Default, incomplete, or overly open settings leave doors unlocked.
Baseline: This is the core of the baseline: platform and server configuration is reviewed and hardened line by line.
Known-vulnerable plugins, themes, libraries, or platforms stay in use after fixes already exist.
Baseline: Core of the baseline: components are inventoried, versions checked, and abandoned items flagged for removal.
Weak login rules let attackers guess, reuse, or bypass credentials.
Baseline: Core of the baseline: two-factor authentication, login throttling, password policy, and admin-account review are standard checks.
Updates or data are trusted without verifying they are genuine and untampered.
Baseline: Partly: update channels and abandoned-plugin exposure are reviewed. Verifying build pipelines and code integrity is outside the baseline.
Without usable logs and alerts, breaches go unnoticed for months.
Baseline: Partly: logging configuration is checked. We do not monitor anything — ongoing monitoring is a separate service we do not offer.
The server is tricked into making requests to internal systems on the attacker's behalf.
Baseline: Not covered. Finding SSRF requires active testing of the application — outside the baseline.
Categories and names follow the OWASP Top 10 (2021), published by the OWASP Foundation as an awareness standard. Listing it here claims no affiliation or certification — it is the map we measure our scope against.
No. The baseline is a defensive configuration and hygiene review of systems you own — settings, updates, access, and hardening. A penetration test actively attacks a system to prove exploitation; we do not offer penetration testing, and we will never describe the baseline as one.
A signed authorisation and a written scope — before anything is touched. Security work only ever happens on systems you own or are authorised to administer, and the signed report states exactly what was checked, what changed, and what remains outside scope.
No — and anyone who promises that is misleading you. The baseline removes the common, known doors: outdated components, weak admin access, missing hardening. It reduces risk honestly; it does not eliminate it.
A signed report in the format shown on our work page: every finding with its evidence, impact, and severity, the remediation applied or recommended, and an explicit list of what sits outside the baseline's scope.
No. We offer no monitoring, no SOC, and no incident-response service — our article and this page say so plainly. The baseline checks that logging exists and is configured; watching it day to day remains your responsibility or another provider's service.
Tell us what you are trying to build or fix. We reply with honest next steps — including if we are not the right fit.