A data breach now costs $4.44 million on average. I find your vulnerabilities before attackers do. Everything manual, by the same specialist, wherever your team is based, with a report they can act on straight away.
Building with Lovable, Bolt or Cursor? See the Launch Check →
Global average cost of a data breach, including fines, reputational damage, customer loss and remediation costs.
IBM Cost of a Data Breach Report 2025Average time before an organisation realises it has been breached. Months during which an attacker roams freely.
IBM Cost of a Data Breach Report 2025Of SMB breaches involve ransomware or extortion, versus 39% at large organisations. Smaller teams, with less IT capacity, are hit hardest.
Verizon Data Breach Investigations Report 2025 (SMB snapshot)I attack your web application the way an attacker would. I test for OWASP Top 10, logic flaws and access control issues. The report describes per finding how it can be exploited and what your development team can do to fix it.
↳ Clarity on which vulnerabilities are genuinely exploitableYour servers, networks and API endpoints are just as vulnerable as the application itself. I look for misconfigurations, exposed services and privilege escalation — things an IT administrator rarely encounters because they only become visible when thinking like an attacker.
↳ Overview of your full external attack surfacePatching without verification is guesswork. After fixes are applied, I retest to confirm the vulnerabilities are actually resolved. You receive written confirmation you can use with regulators or management.
↳ Official proof of remediation, in writingNo security specialist of your own, but plenty of questions? I become your go-to person. You start with a security roadmap, then have fixed hours every month for advice, customer questionnaires and design input. You can also spend the hours on testing.
↳ Roadmap €1,500, then from €950 a monthOne day of manual pentesting on your most important application; despite the name, not an automated scan. Same tester, same approach and the same signed report as a multi-day pentest, just shorter, so with less coverage. You get the key findings and learn whether, and where, a multi-day pentest is needed. €1,000 excl. VAT, retest included.
A thorough pentest of an application with multiple roles usually takes four to five testing days, around €5,000 to €6,000. That's a fair market price, and I offer that test too. If it doesn't fit your budget, I test for less time, not with less care: a Compact pentest from €2,500, or a one-day Security Quick Scan for €1,000, focused on the highest-risk areas. What a scanner does, you can do yourself for free. You don't need to pay me for that.
All prices excl. VAT · retest included · Security Quick Scan (1 day) €1,000 · exact price after a free intake call.
| Service | What it is | Price (excl. VAT) | Time | How to book |
|---|---|---|---|---|
| Attack surface scan (Dutch) | Which domains and subdomains are registered to you? An inventory, not a pentest. Credited against a follow-up pentest. | €1,000 | 1 day | Contact form |
| Security Quick Scan | One day of manual pentesting on your most important application | €1,000 | 1 testing day | Free intake |
| Launch Check | Short fixed-scope pentest for small AI-built apps before launch | €1,099 | Fixed scope | Book online |
| Multi-day penetration test | Compact · Standard · Full | from €2,500 · €4,500 · €7,500 | approx. 2–3 · 4–5 · 6+ testing days | Free intake |
| Security advisor | Security roadmap, then fixed monthly hours for advice. Hours can also go to testing. | €1,500 roadmap, then from €950 a month | 8 hours a month · Plus: + 1 day | Free intake |
Resync deliberately has no account managers or junior staff. You work with the same person from start to finish. I don't outsource and don't involve anyone else.
I have worked with municipalities, healthcare organisations and educational institutions and understand what is at stake: personal data, legal obligations and continuity of service. That requires a different approach than a typical startup.
OSCP, eWPTxv2 and a Master's in Cyber Security are not just credentials. I can penetrate systems in ways that a scanner will never find — which is precisely what manual testing is about.
A pentest isn't formally required for SOC 2 or ISO 27001, but auditors expect one as evidence (CC4.1, Annex A 8.8 and 8.29). Sell to a financial institution? Since 2025, DORA requires them to secure annual testing evidence from suppliers like you. My report maps findings directly to those requirements. SOC 2 & ISO 27001 →
EHR platforms, patient portals and connected devices hold some of the most sensitive data there is. I test them the way a real attacker would, with HIPAA and GDPR expectations in mind.
Checkout flows, payment integrations and customer accounts are a constant target. A penetration test supports your PCI DSS obligations and keeps fraud off your platform.
Apps built with Cursor, Bolt or Lovable contain predictable vulnerabilities: IDOR, exposed API keys, missing endpoint authorisation. Scanners rarely catch them, manual testing does. Dedicated offer →
Organisations operating in the Netherlands and the EU must now demonstrate their security under NIS2. A penetration test report is the evidence regulators, and your European customers, ask for.
Law firms, agencies and advisors hold highly confidential client data with limited in-house IT. Large-firm pricing is out of reach; I offer a fixed-price alternative.
From your first message to the retest: what happens, and when.
Phase 1 · Getting acquaintedFree, no obligation
A few sentences via the form or by email is enough, for example “web app with a login, curious about the cost”. Prefer to talk right away? Pick a time in the calendar yourself.
From me, not from a sales team: usually within a few hours, always within one business day. We set a time for the intake straight away.
We discuss what needs testing, why (audit, NIS2, a customer requirement, a launch) and what stays out of scope. No preparation needed. Want an NDA first? I sign it before the call.
Scope, number of testing days, schedule and price in writing. No hourly billing, no hidden extras. Asking questions or changing the scope costs nothing.
Up to here everything is free and without obligation. There is only an engagement once you approve the proposal.
Phase 2 · The engagementAfter your approval
You approve the proposal and confirm in writing that you authorise the test. Together we pick the start date and arrange test accounts and access.
Fully manual and by me: one testing day for a Security Quick Scan, two to six or more for a multi-day test. Not a scanner you could run yourself. If I find something critical, I report it immediately rather than waiting for the report.
Executive summary and technical details with reproduction steps, useful for both the CISO and the board. Delivered through the secure client portal, not as an email attachment, and no later than 14 days after the last testing day. Includes a 30-minute walkthrough call.
Fixed the findings? I test them again and update the report with their status: resolved or not resolved. Only then do I close the engagement. Want someone to stay involved after that? That's what the security advisor on retainer is for.
No obligation until you approve · Usually a reply within hours
All prices at Resync are fixed, excluding VAT, with a retest included. A one-day Security Quick Scan costs €1,000. A multi-day penetration test starts at €2,500 (Compact), €4,500 (Standard) or €7,500 (Full), depending on scope. Prices are set in euros and can be invoiced in EUR, USD or GBP. Send a request via the contact form and you'll hear within one business day what to expect.
No. At Resync, testing time sets the price, not quality. Every testing day is manual work by the same OSCP-certified tester, with the same report format, a digitally signed report and a retest. What a shorter test has less of is coverage: in one day I focus on the highest-risk areas, such as login, authorisation between users and the most sensitive features. A thorough pentest of a multi-role application usually takes four to five testing days, around €5,000 to €6,000, in line with the market. I offer that too. If that budget isn't there, a Compact pentest from €2,500 or a one-day Security Quick Scan for €1,000 is better value than paying a pentester to run a scanner: a free scanner such as OWASP ZAP is something you can run yourself.
Yes. Almost every engagement runs fully remotely, so where you are based is rarely a constraint. I work with clients across the EU, the UK and the US, arrange calls around your timezone, sign an NDA and contract in English, and can invoice in EUR, USD or GBP. Reporting and communication are in English throughout.
A Security Quick Scan takes one testing day. A web application pentest usually takes three to five testing days; larger platforms take more. Lead time depends on scope: Compact 1–2 weeks, Standard 2–3 weeks, Full 3–5 weeks. After the intake you receive an exact schedule.
Small and medium organisations are a popular target because attackers know there is less security capacity. NIS2 also requires an increasing number of organisations — including SMEs and public sector entities — to demonstrably have their security in order.
A pentest is relevant for any organisation that handles confidential data or is legally required to demonstrate it takes security seriously.
Then you have written proof that your systems withstood a manual attack by a certified tester. That is also a valuable result — for regulators, clients or your own board.
All findings, system documentation and communications are subject to strict confidentiality. A standard NDA is signed for every project. Your data is never shared or stored outside the project.
Yes. Your IT partner manages your systems, but doesn't think like an attacker. Most vulnerabilities I find are not visible to routine IT management because they are discovered by creatively misusing logic and configurations in ways that never arise during normal operations.
One conversation is enough to clarify whether and how I can help. Free, no obligation and a response within one business day.
Tell me in a few sentences about your application or question. I respond within one business day and won't send a quote unless you want one.