Services

Bounded services. Fixed prices.

Every engagement has a scope, a deliverable and a deadline. Prices exclude VAT and travel. Every engagement starts with scoping and written authorisation.

ServiceDurationPriceWhoDeliverable
Exposure Review
Entry offer
1 day€990SME, PSF, fintechReport + 45-min debrief
Web & API Sprint
Core
5 days€6,900SaaS, e-commerce, fintechReport, evidence, retest
Infrastructure & Identity8 days€11,900PSF, HQ, industryReport, mapping, plan
Cloud & Microsoft 3655 days€7,500SME 50–500, PSFConfiguration report
DORA / NIS 2 Readiness8 days€9,900Regulated entitiesGap analysis + roadmap
DDoS Resilience
Controlled test
4 days€5,900Hosting, e-commerceReport, runbook, recommendations
Red Team / TLPT
Scoped
20 daysfrom €32,000Banks, insurersReport, debrief, purple team
Continuous Assurance1.5 d/month€3,200/monthAllMonthly review + critical alert
Board Tabletop1 day€3,900Board, advisorsScenario, debrief, plan

Indicative prices excl. 17% Luxembourg VAT. A signed quote and RoE are required. Discounts above 10% are not practised.

Web & API

The test that finds real entry points

We test authentication, authorisation, APIs, business logic and access controls. Not just a scan: manual review, reproducible evidence and prioritised remediation.

  • OWASP ASVS level 2, API Top 10, horizontal and vertical access control.
  • Business logic: workflows, payments, invitations, password reset.
  • FR/EN report, triaged findings, CVSS, ATT&CK, retest included.

Included

  • Scoping and signed RoE, one domain plus agreed URLs.
  • 5 test days, one retest round.
  • 60-minute debrief and HTML/PDF report.
  • Critical alert within 4 business hours.

Out of scope: persistent exploitation, social engineering, unagreed load testing.

M365 / Cloud

Are your accounts really protected?

A misconfigured Microsoft 365 tenant exposes email, files and identities. We review configuration, roles, guest access and logging without disrupting operations.

  • MFA, conditional access, privileged roles, service accounts.
  • External sharing, Teams, SharePoint, OneDrive, guests.
  • Logging, alerts, backup and incident response.
Why now

NIS 2 and DORA shift attention to identities

Attacks rarely start with a network flaw. They start with an account, a share or a token. An M365 review is often the most cost-effective short-term measure.

Read-only access and configuration captures. We do not modify your tenant.

Compliance

NIS 2 / DORA: turn requirements into an action plan

NIS 2 has been in force since May 2026; DORA requires financial entities to demonstrate operational resilience and testing. We help you prioritise, not pile up documents.

Gap analysis

Mapping between your practices and requirements, available evidence, critical gaps.

90-day plan

Prioritised actions, owners, budget, indicators. A plan the board can follow.

Testable evidence

Pentest, M365 review, tabletop, retest: the evidence regulators and clients expect.

Important. Sodew is not a certification body and does not issue “NIS 2” or “DORA” certification. We produce assessments and evidence, not regulatory attestations.
DDoS resilience

Test your ability to absorb, not attack a third party

We assess detection, failover, scrubbing and runbooks. The test is controlled, authorised in writing, coordinated with the hosting provider/ISP and executed from an isolated lab.

  • Tabletop: roles, decisions, crisis communication.
  • Controlled test on staging or a dedicated range, agreed thresholds.
  • Report, runbook, contract and architecture recommendations.
What we do not do. No DDoS-for-hire, no booter, no third-party target, no amplification, no public “stress test” service. Any such request is refused.

Need a scoped recommendation?

Describe your context. We reply within one business day with a recommendation, not a catalogue.

Talk to Sodew