A fixed-fee assessment of the design, code and cloud, then the fixes that follow, ready for whoever’s checking it.
Free 30-minute scoping call. Fixed fee for the agreed scope, quoted before work starts.
A fixed feeQuoted after the call, before any work starts.
One retest includedWe check your fixes once they’re in.
Design, code and cloudRead as one system, part by part.
A reply in one working dayThen a free 30-minute scoping call.
A customer, an auditor, an insurer, a pentester, or your own AI feature will check your security on the way. Pick yours to see what we hand them.
A fixed-fee assessment reads the design, code and cloud. Findings go to your developers with our pattern, and we retest.
Security assessment, part by partQuoted on the call
See what we assessA fixed-fee assessment answers your customer’s questionnaire from what we test, and fixed-price packs close what’s missing.
Deal ReadyAssessment from €4,500
See Deal ReadyA fixed-fee assessment sorts the failing tests, drafts your replies to the auditor and fits the fixes to your audit date.
Audit ReadyAssessment from €3,600
See Audit ReadyA fixed-fee assessment checks every yes on the renewal form, fixes what isn’t true yet and gives your broker the evidence.
Insurance ReadyAssessment from €3,600
See Insurance ReadyA fixed-fee assessment maps what the feature can read and do, tests whether a message can steer it, and writes your answers.
AI feature checkQuoted on the call
See AI feature checkA fixed-fee assessment sorts the findings, closes the infrastructure ones with packs and checks every fix before the retest.
Pentest findings closedQuoted on the call
See Pentest findings closedWe read the design, the code and the cloud, part by part, and follow what each part can reach. Whoever’s checking, their questions land on one of these.
See everything we assessAlready had a pentest? Here’s what it doesn’t cover.
A customer, an auditor or an insurer wants to see your security before they say yes. We start with a short fixed-fee assessment: their questions answered, with evidence. Then we build only the controls they asked for, as fixed-price packs.
On a free scoping call we work out who’s asking, what they asked for and when they need it. We confirm the fee before any work begins.
We read the settings, the design and the code with your team. Where you’ve agreed it, we test hands-on with the access you set up.
The form or report answered with evidence, the gaps in the order to close them, and a one-page summary you can forward.
Infrastructure fixes as fixed-price packs. Code changes go to your developers with our pattern. We check every fix.
Fixed, and confirmed on the scoping call before any work begins.
Priced after the assessment. You only buy the packs the person asking needs.
After your fixes. Further retests are quoted separately.
Fixed-price fixes, quoted after the assessment. Sized for one cloud, one workspace tenant and under about 50 people. Larger estates are quoted.
Here’s one, as our fictional sample report writes it up. The one-page summary you forward is built from findings like this.
Finding CLD-02High
In the report: deployment permissions can pass an unintended admin role.
Anyone who controls the release pipeline could run code with permissions well beyond deployment, including access to data exports.
UM-SA-001 · Revision 4.0CLD-02Cloud and CI/CD
The release pipeline can run code under an admin role it was never meant to use.
The deployment role may pass any role to the functions it creates and runs. That covers app-runtime, the role it’s meant to pass, and also ops-export-admin, which can export customer data. If ops-export-admin trusts the function service and no other policy blocks it, the pipeline can run code with that role’s authority.
Anyone who controls the release pipeline could run code with permissions well beyond deployment, including access to data exports.
Likelihood 3: it needs the deployment identity and several other conditions to hold. Impact 5: the role it could hand over can export customer data. If another policy layer blocks the path, the rating drops.
Figure 9. The deployment role’s permissions. The pass-role statement names no role, so any role in the account can be handed to a function, ops-export-admin included.
{ "Sid": "DeployFunctions", "Effect": "Allow", "Action": ["lambda:CreateFunction", "lambda:UpdateFunctionCode"], "Resource": "arn:aws:lambda:eu-west-1:111122223333:function:billing-*" }, { "Sid": "PassRuntimeRole", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*" }
The permission statements only. Organisation policies, permission boundaries and the trust policy of ops-export-admin weren’t evaluated, and no function was created.
References: R6, listed on page 25.
Security architects and engineers who’ve answered these forms from the vendor’s side and the reviewer’s. You’ll meet us on the scoping call.
About the teamOn a free 30-minute scoping call we’ll say what we can answer from day one, what needs fixing, and what it costs.
Or write to contact@unmesha.io.
