When to call us

You want to know if the assessment findings are realWhether the "high" items actually lead to an intrusion.
What happens once someone is insideStarting from one compromised PC or user account, how far does it spread.
You run a public web applicationAuthentication, authorisation and input handling on a customer portal or site.
A customer or auditor requires a testA report with reproducible steps and confirmation of the fixes.
Office Wi-Fi of unknown qualityGuest and corporate separation, authentication method.
You want to know if monitoring worksWe report what was detected during the test and what was not.

Types of test

  • External:Everything reachable from the internet: public servers, VPN, mail, websites.
  • Internal:From one device on the office network, or one ordinary user account, how far privileges can be extended.
  • Web application:Manual testing of authentication, sessions, authorisation, input handling and APIs.
  • Wireless:Office Wi-Fi authentication, guest network separation, reach from a visitor's device.
  • Rules of engagement:Targets, time window, prohibited actions (denial of service, data modification) and emergency contacts agreed in writing before the test.

Nothing gets broken. Tests stay within the agreed scope and avoid anything that affects production. Access is evidenced with screenshots and logs; data is recorded as reached, not taken.

How an engagement runs

  1. Scope and rulesTargets, period, prohibited actions and emergency contacts fixed in writing.
  2. ReconnaissancePublic information, domains, leaked credentials, exposed services.
  3. Intrusion attemptManual testing; the path and what was reached are recorded. Critical findings are reported the same day, before the report.
  4. ReportAttack path, reproducible steps for each stage, what was reached, what was detected and the measure that stops each stage, in English and Japanese.
  5. Re-testAfter your fixes the same path is tried again and the result added.

Deliverables

  • Test report in English, Japanese or both: path, steps, evidence, measures
  • Management summary: what was possible and what to fix
  • Prioritised remediation list
  • Re-test results
  • List of actions that were and were not detected, for improving monitoring

Indicative pricing

Starting pointFrom about JPY 350,000Indicative for an external test of a small perimeter. Internal tests, the size of a web application and the number of wireless sites change the price; combined engagements can reach several million yen. Scope and price are fixed before work starts.

Frequently asked questions

What does it cost?

A small external test starts at about JPY 350,000. Internal tests, web application size and the number of sites change the price, and combined engagements can reach several million yen. The re-test is included.

Assessment or test first?

Usually an assessment first, to find the weaknesses, then a test sized by what it found. If a customer requires a test or you run a public web application, we can go straight to the test.

Will it disrupt operations?

No denial of service and no data modification. Anything with a risk of impact is scheduled in advance, and both sides have an emergency contact to stop the test at once.

Can it be run without telling staff?

Yes. To check whether monitoring and response work, the test can be known to only a few people.

Can you work in both English and Japanese?

Yes. Meetings, reports and management briefings are available in English and Japanese, so a foreign head office and the Japanese team can work from the same findings.

Who can see the report?

It is written to be shared with customers, auditors or head office, with a management summary separate from the technical detail. We recommend limiting distribution of the reproducible steps.

Tell us the targets and we will propose the type and scope of test.

What you expose, how many sites you have, and why you want the test (customer requirement, your own assurance) is enough to start.

Contact