Penetration testing for your business website and systems
Your business website, online shop and booking system may have security weaknesses. MEIDAY runs external penetration tests and delivers a report that explains what was found and what needs fixing.
You do not need an in-house security team to order a test. We define the scope together, you see the price before you commit, and you get explanations you can pass to your developer or vendor.
What is a penetration test?
A penetration test, or pen test, is a controlled attempt to find and probe weaknesses in a system, with permission from whoever has the authority to allow it. MEIDAY focuses on external tests, over the internet, within a scope agreed in advance.
The test is designed to avoid deliberately destructive actions, and runs in a time window and at a rate agreed in advance. You name a contact person who can ask us to stop the test.
Which systems can be tested?
These are examples of scenarios a test can cover, depending on the system and the approved scope. Not every scenario fits every site.
- An online shop’s checkout
- Whether a logged-in customer can see other customers’ orders, and whether the server checks for itself what the browser sends it on the way to payment.
- A clinic’s booking system
- Whether one patient can see another patient’s appointments and details, or cancel an appointment that is not theirs.
- The admin login
- Whether there is protection against repeated login attempts, and whether components with known weaknesses are in use.
- A customer portal
- Whether a customer sees only their own documents and invoices, and whether staff-only areas can be reached.
What does it cost?
A public website test starts at
₪1,990 incl. VAT
The price depends on the type of system and the scope of work, not on how many weaknesses we find. The calculator gives an instant estimate, and the final price is confirmed in a written quote after we check the system details.
How to read the report
Every finding gets a severity level that helps you decide what to deal with first. Where relevant, the report also gives a CVSS score on a scale of 0 to 10.
What to hand to your developer or vendor
- The whole report, or at least the technical section. It lists the affected component, the evidence and the recommended fix.
- Your priorities: what gets fixed first, based on severity and the actual impact on your business.
- The retest date. The first retest is included in the price, and it shows whether the fix worked.
Do not send the report over an open channel. It describes how to exploit weaknesses in your system.
What you need to prepare
- The addresses of what you want tested.
- Written confirmation that you own the systems, or that you may have them tested. If a vendor builds and maintains your site, let them know.
- If there is a login: dedicated test users for each user type. Not your staff’s or customers’ accounts.
- One contact who is available during the test and can ask us to stop.
What the test does not do
No test is guaranteed to find every vulnerability, and no report prevents a breach. The test shows what was found within the scope we tested, and what was not tested. A report with no findings does not mean the system is immune.
Want to know what the test will cost?
Answer a few short questions and get an instant price estimate, including VAT. Once the scope is approved, we send a final price in writing.