You can talk to us before requirements are fixed.
Guide: web app assessment from ¥300,000, pre-release risk assessment from ¥200,000/mo|See pricing
Vulnerability assessment that doesn’t stop at the report
A vulnerability assessment looks for holes an attacker could exploit in your web apps and code. As a development company, we don’t just probe from outside — we read the specs and the code to find the cause, and the same team fixes it.
AI has made shipping faster, and more code now goes live before anyone has checked it. Beyond a yearly assessment, we can review every release.
What we assess
Web apps & APIs
We test what can be exploited from outside: login, authorization, input handling, sessions, uploads. Broken access control — seeing someone else's data — is hard for scanners, so we walk the flows by hand.
Basis: OWASP Top 10 / ASVS
Source code review
We read the code for injection, missing authorization checks, hard-coded secrets, and outdated dependencies. Audits of AI-written or outsourced code are also available at a flat fee.
Basis: SAST, SCA, and manual review
AI-powered apps
For AI chat, RAG, and agents: prompt injection, documents leaking into answers across permission boundaries, over-privileged tools, and system prompt leakage.
Basis: OWASP Top 10 for LLM Applications
Exposure & cloud settings
Exposed admin panels and storage, TLS and DNS settings, and entry points left open. We also review permissions on AWS, Google Cloud, and Cloudflare.
Basis: External checks plus configuration review
For an audit of AI-written code only, see the flat-fee code audit.
Pre-release risk assessment (monthly)
Your security team, from outside
Large companies with many in-house products run a risk assessment before every launch, done by their own security team. For companies without one, we take on that role on a monthly retainer.
- Before each release, review specs, code, and traffic for weak points
- For new projects, decide what security design is needed
- Assess the security of external services you integrate (SaaS, APIs, AI services)
- Turn findings into tickets for your developers and verify the fixes
Dependency vulnerabilities and leaked secrets are caught by automated checks in your repository; people spend their time on design and authorization, which automation misses.
How it works
STEP 1
Scoping (free)
We confirm URLs, screens, APIs, repositories, and test environments, then quote.
STEP 2
Written consent
The system owner signs off in writing; we agree on timing, source IPs, and what must not be disrupted.
STEP 3
Testing
Tools and AI surface candidates; engineers keep only what they can actually reproduce.
STEP 4
Report
Severity, reproduction steps, and fixes, plus a readout to set priorities.
STEP 5
Fix & retest
If you want, we fix the issues ourselves and confirm them with a retest.
What we don’t do
Our strength is testing with a builder’s eye
We don’t run full network penetration tests, red-team exercises, 24/7 monitoring (SOC), or post-incident forensics. For those, we recommend a specialist firm.
Pricing guide
Prices are pre-tax guides and vary with scope, integrations, and post-launch operations. Formal quotes are free.
Vulnerability Assessment & Security Review
How is this different from a dedicated security testing firm?
We read the specs and source code to find root causes, and the same team can fix what we find — there is no gap between the report and the fix. We don't run full network penetration tests, red-team exercises, or 24/7 monitoring (SOC); for those, we recommend a specialist firm.
Will testing affect production?
We test in a staging environment by default. If production is in scope, we agree on timing, source IPs, and what must not be disrupted, and avoid heavy-load tests. We start only after the system owner gives written consent, and check the terms of any third-party servers or SaaS involved.
What is a pre-release risk assessment?
Before a new feature goes live, we review its specs, code, and traffic for weak points. Large companies with many products have an in-house security team do this for every launch; we take on that role on a monthly retainer. It can also cover security design for new projects and assessments of external services you integrate.
Can you assess AI-built apps and AI chat?
Yes. AI-written code is covered by source code review. For AI chat, RAG, and agents, we test against the OWASP Top 10 for LLM Applications: prompt injection, documents leaking across permission boundaries, and over-privileged tools. For AI-written code only, there is a flat-fee code audit (JPY 100,000).
Can the report be used for customers or audits?
Each finding comes with severity, reproduction steps, and a fix, plus retest results after fixes. You can use it to explain your posture to customers or for internal audits. It is not a third-party certified report, and our service is not on IPA's list of services conforming to the Information Security Service Standards (as of November 2026). Let us know in advance if a listing is required, e.g. for a tender.
How much does it cost?
Web app assessments start at JPY 300,000 (up to about 20 screens, one retest included); the price depends on screens, APIs, and whether source code or AI apps are in scope. Pre-release risk assessment starts at JPY 200,000/month (about 3 person-days), quoted by release frequency. A flat-fee code audit (JPY 100,000) is available for AI-written code. Scoping and quotes are free.
Contact
You can talk to us before requirements are finished.
We can start by sorting what to do first. We run businesses ourselves, so the conversation stays about labor and ops. Consultation and estimates are free.
Online meetings / reply by next business day / free consult & estimate
01
Talk to us
Via the form or online. Requirements do not need to be fixed.
02
Hearing
We learn how you work today and sort out where to start.
03
Plan and quote
We propose scope, timeline, and cost. Free up to this point.