>> ALERT: UNPATCHED ASSET DETECTED — YOURS

Your website is secure. Until it is not.

43% of cyberattacks target small businesses. 88% of SMB breaches involve ransomware. You lock your office every night. Your website — the door that never closes — has probably never been tested. We test it the way criminals would, then hand you the fix.

Configure your audit ↓ See pricing — openly
// audits from €1,500 · fixed quotes · NDA on request · response within 4 working hours
$3.31M

What one breach costs a company your size

IBM Cost of a Data Breach 2025, organisations under 500 staff (figure in USD): response, downtime, lost clients, legal fallout.

→ Your move: an audit from €1,500 covers roughly 0.05% of that risk. Once.
43%

Of attacks aim at small businesses — not enterprises

Verizon DBIR. Attackers automate: bots scan every IP on the internet, 24/7, looking for exactly your stack — WordPress, contact forms, old plugins.

→ Your move: being small makes you the target. Being tested makes you the wrong target.
194 days

Average time just to identify a breach

IBM Cost of a Data Breach 2024. Over six months of quiet access: your client list, your invoices, your email — copied while you work.

→ Your move: one audit tells you today what you would otherwise learn in six months.
1 in 5

Small firms attacked every year

Hiscox Cyber Readiness Report tracking shows roughly one in five small businesses suffering an attack annually. Most SMB breaches are never disclosed — the client just quietly leaves.

→ Your move: a documented audit is the due-diligence evidence insurers and regulators ask for.
Threat landscape · 2024–2026

What is already
knocking on your door.

These are not theoretical risks. They are the six attack vectors we see in real engagements with Irish and European small businesses.

!

AI-Powered Phishing

AI-written phishing costs 95% less to launch and fools 5x more people. Deepfake voice fraud hit $25M in a single 2024 case.

+340% growth in 2025
$

Ransomware Economics

Average recovery: €120,000. Downtime costs your revenue per hour — plus every client who can't reach you. 96% of attacks go for your backups first. Paying is the beginning, not the end.

88% of SMB breaches
@

Business Email Compromise

$55 billion lost in a decade. One spoofed "updated bank details" email. Average loss per incident: $4.67M at enterprise, fatal at SMB scale.

73% target SMBs
#

Credential Stuffing

2.8 billion passwords are on sale right now. If anyone on your team reuses a password, the attacker is already inside — they just haven't acted yet.

22% of all breaches
%

Human Error

95% of incidents trace back to one click. Training cuts risk 7x. Most small businesses train their staff never.

68% = one staff mistake
</>

Web Application Exploits

Outdated plugins, exposed admin panels, SQL injection in the contact form. A third of SMB breaches walk straight through the website.

OWASP Top 10 territory
The maths of waiting

The cost of doing nothing.

Every framework, regulator and insurer on the planet says the same thing: test before you are tested. Here is what "later" actually costs.

Average SMB breach costIBM Cost of a Data Breach 2025 — sub-500 staff, USD$3,310,000
Ransomware recoveryexcluding the ransom itself€120,000
Downtime, per houryour revenue per hour — plus every client who can't reach youyour number
GDPR exposureup to 4% of turnover — Irish DPC enforces actively€20M cap
Clients lost after a public breachthey never send an email to explain why65%
Cyber-insurance claimdenied without documented due diligence€0 paid out
BUREAU NULL AUDIT — FROM
€1,500

One-time. Fixed quote. CVSS-scored report. Fix roadmap.
That is 0.05% of the average breach cost.

Not our opinion. The industry's.

Every serious security framework mandates exactly what we sell. When a regulator, insurer or enterprise client asks "have you been tested?", these are the standards they mean:

NIST CSF 2.0Identify → Protect → Detect. Step one is knowing your weaknesses — that is the audit.
ISO/IEC 27001Requires regular vulnerability assessment. Enterprise clients increasingly demand it from suppliers.
OWASP ASVSThe verification standard our web application tests are structured against.
PTESPenetration Testing Execution Standard — the methodology for our manual testing phases.
CVSS 4.0Every finding we deliver is scored on the industry-standard severity scale. No vagueness.
GDPR Art. 32"Regular testing and evaluation of technical measures" is a legal obligation for anyone holding EU personal data.
Services & pricing — in the open

Enterprise-grade testing.
Without feeding the enterprise.

Security firms quote €8,000–€25,000 for the scope below because you pay for their sales teams, account managers, certifications theatre and marble offices. We are an atelier: you pay for senior hands and a report you can act on. That is why our prices are published, fixed, and realistic for a business your size.

// no sales department

The person who quotes your audit is the person who performs it. Nothing is lost in handoffs, nothing is padded in margins.

// no enterprise overhead

No offices, no account managers, no vendor kickbacks. The invoice is labour and expertise — nothing else.

// plain-English reports

Every finding: what it is, why it matters to your business, how to fix it. CVSS-scored, ranked by real risk.

MOST BOOKED WAST

Web Application Security Test

€1,500 – €4,500 fixed quote€1,500 covers a single small site/app; larger scopes quoted up to €4,500 — fixed before work begins

For any business with a website, web shop or client portal — built by us or by anyone else.

  • Full OWASP Top 10 coverage, manual + automated
  • Findings scored in CVSS 4.0 — 3.1 vectors provided on request for insurer and procurement compatibility
  • Every finding also carries a separate business-priority rating, explained in plain English
  • Plain-English report + developer fix roadmap
  • One verification pass covering critical and high fixes within 30 days — closed with a signed retest attestation suitable for procurement and insurers
  • Structured per OWASP ASVS / PTES methodology
Configure this audit ↓
ADD-ON / STANDALONE

Manual Penetration Test

+€1,200 or from €2,400 standalone

Deeper than any audit: we attack your existing website the way a motivated criminal would — by hand.

WAST is breadth: every OWASP category checked, every finding listed. A pentest is depth: we pick a business objective — steal the client list, bypass payment — and prove or disprove it end-to-end.

  • Authenticated session & privilege-escalation attacks
  • Business-logic abuse: discounts, refunds, quotas
  • Chained exploits — small bugs combined into breach
  • Your own site, your own stack, white-box or black-box
  • Evidence captured for every successful attack path
Add to my audit ↓
INTELLIGENCE

OSINT Exposure Scan

€600 fixed

What can an attacker learn about your company without ever touching your servers? More than you think.

  • Credential exposure across public breach corpora, stealer-log channels and monitored dark-web sources — collection methods documented in the report
  • Exposed documents, metadata, forgotten subdomains
  • Staff footprint: social, forums, breach databases
  • Attack-surface map of everything public
  • Prioritised clean-up checklist
Map my exposure ↓
The Irish market, honestly mapped

Compare us.
That is the point.

We checked the market before we priced ourselves. Enterprise firms do excellent work — for enterprise budgets. If you are a 5–200 person business, the comparison looks like this:

Provider Typical entry SMB-friendly Manual web pentest Plain-English report Builds & secures
Global MSSPsEnterprise contracts—✓——
Enterprise consultancies€10,000+ engagements—✓——
Subscription scanning platformsAnnual subscription—✓✓—
Traditional pentest boutiquesQuote-only✓✓——
Bureau Null€1,500 — published✓ built for SMB✓✓✓ same hands

// one practice that builds your website and then attacks it — same hands, full accountability, one invoice

Receipts

Audited, attacked, documented.

This is the format your report arrives in. One anonymised finding from a real engagement — client details removed, structure untouched.

BN-2026-014 CRITICAL · CVSS 4.0: 9.1
Authenticated SQL injection in client portal export
VECTORCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
REPRO1. Authenticate as a standard client-account user.
2. Open Clients → Export CSV; tamper the from_date parameter with ' OR '1'='1.
3. The export returns the full clients table — including other tenants' rows.
IMPACTFull client-list exfiltration by any registered user: GDPR Art. 33 72-hour notification, contractual penalties, churn.
FIXParameterised queries on the export path; tenant scoping enforced at the query layer; regression test added to CI.
RETESTVerified fixed — 12 days after report

Manual testing led with Burp Suite Professional; every scanner result hand-verified — no copy-pasted scanner noise.

All evidence encrypted at rest, handed over with the report, purged 90 days after engagement close.

A typical WAST is 2–4 days of hands-on testing plus reporting; the fixed quote reflects scope, not hours.

// rules of engagement

Availability-safe by default: no DoS or stress testing, rate-limited traffic, agreed testing windows, immediate stop on your word. Your site stays live; your clients notice nothing.

Hack The Box Pro Labs practitioners — Dante completed, CPTS track in progress. We will show you the live profile on a screen-share before you sign anything.

Vanguard — full WAST + signed retest attestation → Horizon — OSINT due diligence ahead of an acquisition → SecureCloud — CVSS dashboard build, 97 Lighthouse → Cipher Medical — patient portal, GDPR-grade hardening →
Security calculator

Configure your engagement.

Fixed quotes, no surprises. Set your scope — the price updates live. Press ⓘ on any line to see exactly what is included.

// STANDARD LEAD TIME 2–3 WEEKS — ENGAGEMENTS ARE SLOTTED FIRST-COME, ONE AT A TIME

// latest engagement: 17 findings, 2 criticals, retest attested in 12 days — see a real finding above

Engagement
What we test and how deep we go
WAST audit (€1,500): OWASP Top 10, CVSS-scored report, fix roadmap, 30-day verification pass for critical and high fixes, with signed retest attestation.
WAST + manual pentest (€2,700): adds hand-executed attacks on your existing site — sessions, business logic, chained exploits. Bundle saves €1,200 vs booking separately.
OSINT scan (€600): leaked credentials, exposed documents, attack-surface map.
Full spectrum (€3,300): the €2,700 bundle plus OSINT. Enterprise equivalent: €15,000+.
Extra targets
€250 per additional domain / app / environment
0
The base engagement covers one target — one domain or application. Add your staging server, client portal, API, or second brand here. Testing anything you do not own is illegal — we verify ownership before any work.
Executive report + workshop
Board-ready summary + live remediation session
The standard report is written for whoever fixes things. This adds a non-technical executive summary for owners, boards, insurers and enterprise clients — plus a 60-minute live call where we walk your developer through every fix. Often required for cyber-insurance and ISO 27001 evidence.
Annual re-test
Same scope, re-tested within 12 months
Every update, plugin and new feature changes your attack surface. A locked-in re-test within 12 months at a 40% discount to the base rate — this is what "regular testing" in GDPR Art. 32 and NIST CSF actually looks like on paper.
Priority scheduling
Work begins within 7 days
Standard lead time is 2–3 weeks. Priority puts your engagement at the front of the queue. If you suspect you are already compromised, email us instead — incident triage is a different, faster conversation.
Cash payment
Pay on completion, in cash — declared and invoiced
Some clients prefer to settle in cash when the report is handed over. Fully legal, fully declared: you receive a VAT invoice and receipt like any other payment. Ticking this box simply tells us your preference — we confirm the arrangement in the engagement letter. Same fixed price either way.
YOUR INVESTMENT
€1,500
+ VAT 23% where applicable · 50% to schedule · 50% on report delivery
Enterprise quote for this scope: €8,000 – €25,000
Cash preference noted — price unchanged
// bundle applied — €1,200 stays in your pocket

// locked in writing: fixed quote · 100% refund if we can't deliver · you own the result on final payment

Request this engagement → // tick to unlock — 4 seconds, protects both sides
Objections

We have heard them all.

We are too small to be targeted.
43% of all attacks target small businesses. Bots do not check your turnover. They scan every IP on the internet, 24/7, for known weaknesses. You are not too small — you are exactly the right size: big enough to pay, small enough to be unguarded.
Our hosting provider handles security.
Hosting secures the server. Your application — the login forms, the contact form, the checkout — is your responsibility. SQL injection and broken authentication happen at code level, where hosting ends and your liability begins.
We had a penetration test last year.
Good — you are ahead of 90% of your competitors. But every update, plugin and new feature changes your attack surface. Annual testing is the floor, not the ceiling — and it is exactly what GDPR Art. 32 means by "regular testing".
Security audits are too expensive.
Enterprise audits are. Ours start at €1,500 — because we do not feed an enterprise. Against an average breach cost of $3.31M (IBM 2025, sub-500 staff), that is insurance priced at 0.05% of the risk. Expensive is discovering the breach after your clients do.
We do not collect sensitive data.
You have contact forms, email addresses, invoices — and a reputation. A defaced homepage or a hijacked email account costs you clients even when no data is stolen. Your brand is the asset. The audit protects it.
We will do it later.
The average breach takes 194 days just to identify (IBM 2024). "Later" is the most expensive word in cybersecurity — the attackers' timeline does not wait for yours. An audit this quarter costs €1,500; a breach this quarter costs everything above.
Our developer says the site is secure.
They may be right — and a second pair of adversary-trained eyes is how you prove it. Builders and breakers are different skill sets; that is why the industry separates them. Your developer keeps their job. You keep your business.
We have a firewall and Cloudflare.
Excellent — perimeter tools stop the lazy attacks. They do nothing for broken access control, business-logic abuse, or the plugin vulnerability published last Tuesday. A WAF is a fence. We check whether the building has doors.
Nobody knows we exist. Why would they find us?
They already have. Scanners do not browse — they enumerate. Your IP sits in ranges scanned thousands of times a day, whether you rank on Google or not. Obscurity is not a strategy; it is a delay.
What if you find nothing? Do we still pay?
Yes — and a clean report is a deliverable, not a disappointment. It is the documented due diligence your insurer, your enterprise clients and the DPC all ask for. In sixteen years, we have never delivered an empty report.
What happens after you press the button
/01

Reply within 4 working hours.

A senior engineer — not a salesperson — replies with scoping questions and a fixed quote. NDA signed before you share anything sensitive.

/02

Engagement letter.

Scope, rules of engagement, timing and price in writing. Testing begins only after you sign — and only against assets you own or control.

/03

We attack. Quietly.

1–3 weeks depending on scope. Your site stays live; your clients notice nothing. You get a mid-engagement heads-up if anything critical surfaces early.

/04

Report + fix roadmap.

Every finding CVSS-scored, explained in plain English, with exact remediation steps. Critical and high fixes verified within 30 days — closed with a signed retest attestation suitable for procurement and insurers.

/05

You sleep again.

Optional annual re-test keeps the evidence current — for insurers, for enterprise clients, for the DPC, and for you.

>> END OF FILE. DECISION REQUIRED.

Untested is not the same as safe.
Hope is not a control.

Every untested website carries a debt it has not been billed for yet. The audit is how you find out the number — on your terms, before someone else presents theirs.

You have read the numbers. You have seen the price. The only variable left is who gets there first: us, or someone with worse intentions and a longer timeline.

The request below costs nothing and commits you to nothing. It starts a conversation with the people who will actually do the work.

// no obligation · NDA available · fixed quote before any work Configure your audit →
or write directly: hello@bureaunull.com · reply within 4 working hours