Johannes Werner · RAKITIN
What an attacker can see about your company before they ever call.
The security check examines everything your company exposes to the internet, from the exact angle an attack starts: outside, no credentials, no inside knowledge. You get a findings report that ranks every finding by urgency and tells you what to do about it.
- critical Administrative interface reachable with no access restriction Block it or move it behind the VPN. About one hour of work.
- high SPF and DMARC incomplete, sender address can be forged Two DNS records. Stops invoice fraud sent in your name.
- medium TLS certificate expires in nine days Automate renewal, otherwise your customer-facing site goes down.
- low Server banner discloses the software version in use Turn the banner off. It removes an attacker's shortlist.
Your firewall protects the inside. This looks at the outside.
Most incidents in mid-sized companies do not start with an attack on the data centre. They start with something that is accidentally public: a forgotten test server, an open admin portal, an expired certificate, a domain that anyone can send invoices from. None of it appears on the network diagram. All of it appears on the internet.
- Your IT provider looks after what your IT provider built. This check covers everything visible from outside, including what predates them.
- A finding nobody explains never gets fixed. Every finding in the report comes with an action, an effort estimate and a position in the queue.
- You end up with a document you can take to your board, your insurer or your auditor.
What you hold five working days later
-
Findings report as a PDF
Every finding with evidence, an urgency rating and a concrete action. Written so your IT people can work from it.
-
One-page management summary
No jargon: where you stand, what the risk is, roughly what fixing it costs.
-
Prioritised action list
In the order it should be worked through. What matters today sits at the top.
-
Debrief call
Thirty minutes so the questions about the report are answered before it gets filed away.
-
First retest after two months, free
The same scope again, so you can evidence that the findings are closed.
-
Evidence kept for twelve months
Report, scope and authorisation record stay available for twelve months, which outlasts the retest window.
What is tested, and what explicitly is not
Included
- Publicly reachable services and open ports on your domains
- Encryption: TLS configuration, certificate chains and expiry
- Email sender protection: SPF, DKIM and DMARC
- DNS configuration, subdomains and forgotten records
- Login and administration interfaces reachable from outside
- Security-relevant headers and configuration of your web properties
- Publicly discoverable software and version disclosure
- Credentials for your domains that have surfaced in public breach data
Not included
- No exploitation of findings and no changes to your systems
- No load testing and nothing that can disturb live operations
- No social engineering and no phishing simulation against your staff
- No internal network testing and nothing without authorisation
- Not a full penetration test and not an ISO 27001 certification
Only what you name in the order and then authorise in writing is tested. Third-party systems, your hosting provider for instance, are touched only insofar as they serve the domains you named.
Four steps, no meetings in between
-
Order
You fill in the form below. About three minutes. No sales call follows.
-
Authorisation
You immediately receive a personal link by email. There you confirm the scope in writing. Nothing is tested before that confirmation.
-
Testing
The check runs from outside with no intervention in your systems. Operations notice nothing.
-
Report
Within five working days of your authorisation you get the report, then the debrief.
690 euros, one-off, no follow-on costs
plus statutory VAT
The service is provided by RAKITIN Limited, established in Cyprus (EU). For businesses in Germany and the rest of the EU holding a valid VAT identification number, the invoice is issued without Cypriot VAT and the liability shifts to you under the reverse-charge procedure (Article 196 of the EU VAT Directive). Without a valid VAT identification number, statutory VAT is charged. This is general information and does not replace tax advice.
14-day money-back, counting from delivery of the report
If the report was not worth it to you, email me within 14 days of delivery. You get the full 690 euros back, no reason required, and you keep the report.
Retests
The first retest, two months after the check, is free. A further retest in the six to twelve month window after the first check costs 190 euros.
Payment
Invoice after the report is delivered, payable within 14 days by bank transfer. No prepayment, no subscription, no automatic renewal.
What people ask before they order
Is this legally clean?
Yes, and that is exactly why the authorisation step exists. Testing only begins once you have confirmed the scope in writing through your personal link. That confirmation is recorded with a timestamp and kept for twelve months, for you and for me.
Will the check disturb our operations?
No. It looks from outside, it does not intervene. No load testing, no exploitation, no changes to your systems. Your hosting logs will show the requests, and that is all that happens.
We already have an IT provider.
Good. The report is not aimed against them, it is written for them. Every finding is phrased so your provider can work through it without coming back with questions. In practice an outside view mostly finds what grew historically and what nobody feels responsible for.
What if you find nothing?
Then you have that in writing, with a date and a defined scope, and you can hand it to your insurer, your auditor or your customer. If the report still was not worth it to you, the money-back promise applies.
Who gets to see the results?
Only the people you name in the order. Nothing is passed to third parties, nothing is published, and nothing is used as a reference without your explicit consent.
How long does it take and what do you need from us?
Five working days from your authorisation. I need the domains to be tested and one person who is allowed to authorise the scope. Nothing else: no credentials, no system access.
Is this a penetration test?
No. A penetration test exploits findings, runs for weeks and costs many times more. The security check answers the question that comes first: what is visible and attackable from outside at all. For many companies that is where you start.
Order the security check
Fill it in, send it, done. You receive the order confirmation and the scope authorisation link straight afterwards. No callback needed, no sales conversation.
Order received
The order confirmation and the scope authorisation link are on their way to your inbox. Confirm the scope there and the check begins.
Your order number: