Seven shelves, ordered by what you need. If you are not sure where to start, start with the first one: it is free.
Free
An automated system looks at what your company shows on the internet (domain, email and servers) and tells you what it found, what it could cost you and how to fix it.
Automated passive recon: DNS, SPF/DKIM/DMARC, TLS, exposed technologies and known CVEs. No active testing. With no sign-up you see what is public; with an email at your domain you get every finding with its fix and a leadership brief.
In minutes · No credit card needed.
Check for freeWork out what each type of attack would cost you, with the sources in plain sight. It is an estimate and says so.
Typed model with a source for every figure, typical and bad-case ranges, and legal level by country. An estimate, not advice.
CalculateShort checks you run yourself: your email, your site’s headers, whether your chatbot can be tricked and how ready you are for ransomware.
SPF/DKIM/DMARC, HTTP headers, AI provider keys in public JS (verified domain), a short prompt injection battery and a CIS IG1 questionnaire.
Without paying: verify your domain and we check it once a month, writing only if something changed. If you have no serious open risks, you can show the “Monitored by LOP.run” badge.
Free plan: monthly passive re-check with a verified domain (DNS TXT record or domain email) and a badge, without the full trust page.
Find
Sniff
A Lop (that is what we call each specialist on our team) studies your case, talks with you for 30 minutes and tells you which service you need, at a fixed price.
Human review of the passive scan, a 30 minute interview and light non-intrusive tests under signed authorization. Deliverable: diagnosis, recommended service and a fixed quote.
A Lop tries to get into your systems the way an attacker would, without breaking anything. You get a report with every problem, what it could cost you and how to close it. Once you fix it, we test again.
Manual pentest under signed authorization and rules of engagement. Each finding is confirmed with a proof of concept, scored with CVSS 3.1 and comes with business and legal impact, a fix and a retest.
Every audit includes
Dig
For companies with one web system: a website, online store, content manager or intranet. For example, a store with its admin panel. We also check your email and your Microsoft 365 or Google Workspace accounts.
1 web application (up to 2 roles) with full OWASP WSTG: injection, XSS, IDOR, authentication and sessions, file upload, CMS and plugins. External surface up to 10 hosts. DNS, TLS and SPF/DKIM/DMARC. Microsoft 365 or Google Workspace configuration (CIS).
1 to 2 weeks · We retest for 3 monthsUnlimited retests for 3 months
Rabbit Hole
For companies that run on their own software: your customers pay, book or work inside it, or you have several apps or an API. For example, a fintech, a SaaS or a booking system. Includes everything in the previous audit.
Everything in Dig, plus: up to 3 applications or 1 platform, REST or GraphQL API (up to ~80 endpoints, OWASP API Top 10), up to 4 roles, business logic, tenant isolation, 1 cloud account (CIS) and dependency review (SCA).
2 to 3 weeks · We retest for 6 monthsUnlimited retests for 6 months
Warren
For companies that need everything checked: all of the above, plus your office network, your internal systems and any modules you add. It is built to fit, and you get the quote before we start.
Custom scope: multiple platforms, internal network and Active Directory pentest through LOP BOX, segmentation and the chosen modules.
From 3 weeks · We retest within the period we agreeCustom retest window
Each price covers a scope with clear limits. If your system is bigger, you get a fixed quote before we start. We never charge more halfway through.
Fixed price per scope unit (applications, roles, endpoints, hosts). Beyond those limits, a fixed quote before signing.
Torn between two? The diagnosis with a specialist tells you, and it is deducted from the price.
Most can be hired on their own. The extra web application and the mobile app are added to an audit. Each one has its own price.
They extend the scope of any audit: OWASP MASVS for mobile, Solidity and EVM for contracts, CIS for firewalls.
| Your website and your serversDig | Your platformRabbit Hole | Your whole companyWarren | |
|---|---|---|---|
| Web systemsWeb applications (OWASP WSTG) | 1 | Up to 3 | Custom |
| User typesRoles | 2 | 4 | Custom |
| Servers exposed to the internetExternal surface: ports and services | |||
| Nobody sends mail in your nameSPF, DKIM and DMARC | |||
| Your Microsoft 365 or Google accountsM365 or Workspace configuration (CIS) | |||
| Connections between systemsREST and GraphQL APIs (OWASP API Top 10) | |||
| Business rules: payments, coupons, limitsBusiness logic | |||
| One customer cannot see another’s dataTenant isolation (multi-tenant) | |||
| Your cloudCloud configuration (AWS, GCP, Azure) | |||
| The libraries your software usesDependency review (SCA) | |||
| Your office network and internal systemsInternal network and Active Directory | |||
| Duration | 1 to 2 weeks | 2 to 3 weeks | From 3 weeks |
| We retestRetests | 3 monthsUnlimited, 3 months | 6 monthsUnlimited, 6 months | CustomCustom window |
| Price | US$4,500 | US$9,500 | from US$15,000 |
Fix
Lop Fix
A Lop fixes what we found, by the hour or at a fixed price. Every fix is retested before we call it done.
Remediation of configuration, patches, hardening and code, verified afterwards.
US$95/hour
minimum US$150 A short fix is billed US$150 even if it takes less time. If it takes longer, it is billed by the hour: US$95 each.
Monitor
An audit checks one moment. Then things change: a new server, a flaw published in software you use, a password uploaded to the internet by mistake.
Continuous external surface monitoring: continuous diffs of subdomains, ports, services, TLS, DNS and email. New CVEs and KEVs on the detected stack. Secrets in public repositories.
Ears
We watch all of that around the clock and alert you by WhatsApp, Telegram or email. You see the status in your dashboard, get a monthly report and have a trust page to show your customers.
Continuous automated scanning, 24/7. Alerts by WhatsApp, Telegram, email or Slack. Dashboard, monthly report and a public trust page with status and history.
Covers 1 domain and up to 50 servers or subdomains.
1 root domain, up to 50 assets (hosts or subdomains).
US$149/mo
Ears + Lop
The same, but a person confirms every alert before it reaches you and tells you what to do. We retest everything every three months.
Human triage of every alert (no false positives in your inbox), remediation advice and a quarterly retest.
Covers 1 domain and up to 50 servers or subdomains.
1 root domain, up to 50 assets (hosts or subdomains).
US$449/mo
Paid yearly: 2 months free. Ears: you pay US$1,490 for the year instead of US$1,788 (10 months instead of 12).Ears + Lop: you pay US$4,490 for the year instead of US$5,388 (10 months instead of 12).
Protect your team
Hutch
We find the doors ransomware gangs use and tell you which ones to close first. We simulate a harmless attack to see whether anyone notices, restore your backups against the clock and rehearse the plan with your leadership. You will know how many days you would last and how to get back to work sooner.
Four pillars. Prevent: KEV-prioritized patching, MFA, Active Directory hardening and segmentation. Detect: real attacker techniques run in a benign way (Atomic Red Team) to measure whether your EDR alerts and how long it takes someone to notice. Resist: immutable backups and a real timed restore. Recover: response plan and a tabletop exercise with leadership.
It is not a questionnaire: we measure it with real tests on your network.
Output: a score per pillar, estimated days to withstand and to recover, and a prioritized roadmap.
To reach your network you install a test virtual machine. It connects to us over an encrypted channel and you switch it off when we finish.
Internal access through LOP BOX: a virtual machine or mini PC with an encrypted outbound tunnel, no inbound ports opened. You control the off switch.
3 to 4 weeks · We measure again after 3 monthsRe-measurement at 3 months
from US$5,900
one-time payment
Whisker
Someone poses as your supplier and asks you to pay into a different account. We work out with your payments team how to verify every change, practice it and set up alerts in your email.
Supplier bank detail change verification procedure, payments team training and technical alerts: forwarding rules, unusual sign-ins, lookalike domains and DMARC at reject.
US$1,900
one-time payment · Up to 50 people.
Cheshire
Five things, by name: a map of the AI your team uses, a signed usage policy, training against fake voices and videos, a drill with the owner’s cloned voice and a test of your chatbot.
Shadow AI inventory (OAuth apps and a 10-question survey), AI use policy, a 60-minute session with a code word, a cloned voice drill on up to 10 people with written consent and a prompt injection test on the site chatbot.
US$2,900
one-time payment · Up to 50 people. A full pentest of a chatbot or agent with access to your systems is added as a module.
Respond
Bounce
If you have already been attacked: we stop the damage, recover your accounts and devices, keep the evidence and tell you who you have to notify under your country’s law.
Containment, eradication and recovery of accounts and endpoints, evidence with chain of custody and regulator notification by jurisdiction.
US$190/hour
Minimum US$1,520: the first day (8 hours). With Burrow, the first day of one incident a year is on us.
All in one
Burrow
Your security team without hiring one: monitoring with a person, one audit of your website and servers a year, 6 hours of fixes a month and priority response. If you are attacked, the first day is on us.
Ears + Lop, one Dig a year, 6 h/month of Lop Fix, priority response and the first 8 h of Bounce on one incident a year.
US$1,290/mo
You save US$104 a month compared with buying the parts separately. By parts: Ears + Lop US$449, one Dig a year (US$4,500 spread over 12 months: US$375) and 6 hours of Lop Fix US$570. Total: US$1,394 a month.
You see every problem, where its fix stands and the monitoring alerts. You download your reports and your certificate. Each person chooses business or technical view.
Findings with CVSS severity and remediation status, retest history, monitor alerts, report downloads and export to Jira or GitHub. Business or technical mode per user.
The two reports from a sample audit: one for leadership and the full technical one for your team.
See the sample reportsA person on our security team, with verified certifications, who signs what they deliver. We use aliases to protect their privacy. If your contract requires it, we share their details under a confidentiality agreement.
A scanner, or a pentest run only by AI, gives you a list of alerts, many of them false. We confirm every finding by hand, tell you what it could cost and how to close it, and a Lop signs the report.
No. We work within a date window and a scope you sign beforehand, and we run no tests that take services down or delete data.
You still get the report with everything we tested and how, signed by a Lop, plus the certificate. It works as evidence for your insurer, your auditor or a customer who asks for it.
Tell us what your company has and we will tell you which one fits. If it is the cheapest one, we will say so.