Website Security Scan
We detect the vulnerabilities on your site and report the points that put you at risk.
Cyber Security
Cyber Security Services
Protect your business against digital threats.
01
Our services
End-to-end security services that protect every digital asset, from your website to your employees.
KVKK/GDPR Compliance Audit
We review your data-processing practices to keep you legally compliant.
Phishing Simulation Test
We test your employees against phishing attacks with realistic scenarios.
Security Policy Creation
We prepare an applicable information-security policy tailored to your organisation.
Penetration Test
We test your systems with real attack scenarios to surface weaknesses.
Regular Monitoring
Periodic re-scan of your external surface with a monthly report of what changed since the last run.
02
Packages
Choose what fits your organisation. Packages can be purchased separately or together.
Tier 1 · External attack surface assessment
from €2,200
- Domain and subdomain discovery, open ports and services
- Email authentication (SPF, DKIM, DMARC) and TLS posture
- Typosquat domains, exposed admin panels, known vulnerability (CVE) matching
- External and unauthenticated; rate-limited with automatic safety brakes, active tests run only with written approval
- Signed report (Turkish; English on request) with prioritised findings and fixes; becomes your baseline
Best for: SMEs, universities, hospitals, municipalities: the first step
Get a quoteTier 2 · Web application and API security test
from €2,800 / platform
- Manual authorisation testing of logged-in systems: customer portals, e-commerce, booking and application systems, LMS
- IDOR and access control, API authorisation, authentication and sessions, file upload, stored XSS
- Runs under written authorisation with a test account; priced per platform
Best for: Organisations with login-based web systems
Get a quoteTier 3 · Active Directory security posture assessment
from €1,750
- Credentialed, read-only review inside the network
- Kerberoastable and AS-REP accounts, weak password policy, ADCS certificate misconfigurations
- Attack paths are planned, never executed; a posture assessment, not an internal pentest
Best for: Windows domains; multi-campus scopes on request
Get a quoteTier 4 · Regular monitoring
from €99 /mo automated
from €299 /mo expert-reviewed
- Periodic repeat of the baseline assessment
- Monthly delta report: new services, ports and subdomains, closed and open findings
- Requires the Tier 1 assessment as the baseline; the asset limit is set in writing in the quote
Best for: Organisations whose surface keeps changing
Get a quoteManual finding validation (Tier 1 add-on): hands-on verification of critical and high findings under written authorisation, with evidence, delivered as a signed annex to the Tier 1 report. From €900 for up to 5 findings.
Penetration test: a separate engagement, not part of the tiers above. Scenario, methodology and deliverables are defined in writing for each project; scope and price are set in the quote.
Continuous monitoring: 24/7 monitoring through an agent installed on your endpoints, a separate service from Tier 4. Scope, start date and price are set in the quote.
Starting prices in EUR, excluding VAT. Tiers can be purchased separately or together; the final price is confirmed in writing after a short scoping call, based on the number of assets and the scope. Every engagement starts with a written scope and a signed authorisation (ROE).
03
Fjordex: our assessment engine and its MCP connector
Fjordex is ArveNova's attack-surface and vulnerability assessment engine. It maps the external surface with passive and authorised active discovery, matches discovered service versions against NVD-based CVE data, reads Active Directory security posture with credentialed read-only access, and delivers a signed Turkish report plus a monthly delta report. Every run passes a written authorisation gate.
The Fjordex connector (MCP) is the passive preview of that engine: email security (SPF, DKIM, DMARC, MTA-STS, BIMI), DNS hygiene, exposed subdomains and look-alike domains, read only from public DNS and Certificate Transparency data. Add it to your AI assistant once (Claude is supported today, ChatGPT is coming), then ask "check my domain".
What it is not: not a SOC and not 24/7 monitoring, not a penetration test, not an RMM or EDR agent. Findings come from deterministic rules, not from the language model. The connector output is a preview; the signed report starts at Tier 1.
04
Quote / Contact
Fill in the form and we will get back to you shortly.