NO. 01 / 07 / Security Audit / Website hardening / Est. 2026
3 reviews / month
Surface / Review / Fix / Watch [ The Surface Check is free / Everything after it is not ]

THE ONLY DOOR
YOU DIDN'T CHOOSE.

Your website is the only door into your customer data that you did not choose. We look at what is already public, then — under a signed authorization — at what an attacker would actually find. Then we fix it, re-scan to prove the fix landed, and keep watching.

  • 01A free passive check of what is already public — no account, no contract
  • 02Every finding carries evidence, the exact location and the exact fix
  • 03Fixes land on a branch and are re-scanned to prove they worked
  • 04A watch that only tells you what is new, what came back, and what expires
Direct intake Five fields / we reply within one working day

Request the Surface Check

Five fields / we reply within one working day

NO OBLIGATION · CONFIDENTIAL DIRECT RESPONSE

01Surface
02Scope
03Evidence
04Fix
05Re-scan
06Diff
07Watch
08Date
NO. 02 / 07 What it is / four parts

Four things, and nothing else.

NO. STAGE SCOPE & DELIVERABLES ↗
01 The Surface Check free / what any stranger can already see 02 The Authorized Review a signed scope first / every class, black-box 03 Remediation on a branch / re-scanned to prove the fix landed 04 Watchtower on a schedule / new, come back, expiring 05 What it is not not a scanner, not a pentest, not a builder 06 The first call fifteen minutes / we read the page together
NO. 03 / 07 The free thing

First we read what is already public. That part is free.

We look at your public footprint the way anyone on the internet can, and we tell you what we found. No account, no contract, no scan of your site.

01

Exposed mail configuration

SPF missing, DMARC absent. Written the way a stranger reads it, not the way a plugin prints it.

02

Forgotten subdomains

Certificate transparency lists every certificate ever issued for your name. Four of them still resolve. Most owners have never heard of that list.

03

A live key, committed

Public repositories are public. One API key committed three months ago is still one API key with your name on it.

04

Transport and headers

TLS fine, HSTS missing. Written down honestly, with the date we looked and what we did not check.

NO. 04 / 07 Before you ask

This is for some of you. It isn't for all of you.

Get in touch if

  • 01You own the business, or you decide.
  • 02Your website handles customer data, bookings, payments or sign-ins.
  • 03You have had a site for more than a couple of years, or you did not build it yourself.
  • 04You could name one thing you are not sure about.

Please don't if

  • 01You want a penetration-test certificate for a compliance checkbox. We will tell you honestly what your regulator actually requires.
  • 02You want a new website, a redesign or a logo. That is a different conversation.
  • 03You have no live site yet.
  • 04You need it free to try. The Surface Check is free. The rest is not.
Want the site built or rebuilt instead? FoundationGroup does that. We harden and prove the one you already have.
NO. 05 / 07 Proof

No case studies yet. This shelf is empty on purpose.

No case studies yet. This shelf is empty on purpose.

A finding, the evidence, the fix, and a date.

Every security pitch shows a dashboard climbing and a badge in the footer. Neither is a fact about your site, and a badge proves nothing about this week.

What we will show you is what we actually found, where it was, what it would take to use it, and the day we looked. If we find nothing, that gets written down too — along with everything we did not cover.

Request the Surface Check
NO. 06 / 07 Commercial

One price per market, per service. The card is not published yet.

The Authorized Review

One-time, per site.

Fixed per engagement
  • Every vulnerability class, black-box, against the live site
  • A signed authorization before the first active probe
  • Every finding with evidence, impact, location and fix
  • SARIF output and a signed evidence bundle
Start with the free check
The part that changes anything

Remediation

One-time, scoped to what we found.

Quoted before work starts
  • Fixes implemented on a branch
  • Re-scanned to prove they landed
  • The pull request and before-and-after evidence
  • A note on anything we could not fix, and why
Request the Surface Check

Watchtower

Monthly, per site.

One monthly price
  • Scheduled re-scan, diffed against last time
  • Told when something new opens
  • Told when something we fixed comes back
  • Told when a certificate is about to expire
Start with the free check

The numbers are not on this page yet, and we would rather say that than invent them. The structure is fixed: the review is one price, the fixes are quoted before work starts, the watch is one monthly price per site. No hourly billing — you approve a line item, not a meter. The Surface Check is free and stays free.

NO. 07 / 07 Questions

Ask us anything.

What exactly do I get?+
Four things. A free passive check of what is already public about your site. A full review of what an attacker would actually find, under a signed authorization, with evidence. The fixes, implemented on a branch and re-scanned to prove they worked. And a watch that re-checks on a schedule and tells you the moment something changes.
Is this a scanner?+
No. A scanner is bought by the seat and compared to a self-serve product, and it assumes you have the time to operate it — which is exactly the time you do not have. We operate it, and a person is responsible for the result.
Is this a penetration test?+
No. A pentest is a document you get once. Most owners have had one, or think they have, and nothing changed. The change is the product here — the fix, the proof that it landed, and somebody still watching.
Do you need permission to look?+
For the Surface Check, no — we look only at what is already public, with at most one benign request that identifies itself. For anything active, we need a signed authorization first: the scope, the window, and the test types. Without that we do not probe. That is not paperwork; it is the law in most places we work.
What if you find nothing?+
Then we write that down, with the date, and we write down what we did not cover. We do not sell a clean bill of health we cannot prove, and we are not going to tell you your site has been hacked — we do not know that, and it is usually false.
Will you build me a new website?+
No. We harden and prove the one you have. If the real problem is that the site is old, slow and unmaintained, a rebuild is the better answer, and FoundationGroup does that.
No. 09 / 07 / Start with the check START A BRIEF
REQUEST THE CHECK.
Security Audit
Website hardening, monthly
Egypt first, then the UK and the GCC
Instagram WhatsApp