Capabilities

Capabilities & Engagement Options

A concise overview of our services, evidence and delivery process.

01 — Focus

Manual Web/API assessments for authentication, authorisation and financial workflows across fintech, crypto and gaming applications.

02 — Approach

Asset mapping, automated checks and manual review are combined within an agreed scope. We test assumptions across roles, workflow states and connected services.

03 — Published experience

14,650 client findings · 25+ engagements · 2025–2026. Definitions and severity breakdown.

04 — Relevant cases

Crypto exchange45 findings / 8 Critical / 15 HighPayment platform77 findings / 12 Critical / 28 High

05 — Starting packages

RECON

External Surface Review

An agreed domain and asset list.

$500+

FIXED QUOTE AFTER SCOPING

  • Attack surface inventory
  • Exposed services and configuration
  • Validation of selected exposures
  • Prioritised executive summary

Authenticated application testing is quoted separately.

Discuss RECON
CORE

Focused Web & API Pentest

An agreed application scope and priority user journeys.

$2,000+

FIXED QUOTE AFTER SCOPING

  • Authentication and access control
  • Selected business logic workflows
  • Manual validation and reproducible PoC
  • Technical report and remediation call

Roles, endpoints and workflows are agreed before the quote.

Discuss CORE
DEEP

Extended Application Assessment

A broader review of connected application components.

$5,000+

FIXED QUOTE AFTER SCOPING

  • Cross-service vulnerability chains
  • Agreed web, API and mobile scope
  • Targeted code or cloud review if scoped
  • Retest of reported issues included

The statement of work names the assets and retest window.

Discuss DEEP
TOTAL

Security Assessment Programme

A coordinated assessment across agreed systems.

$15,000+

FIXED QUOTE AFTER SCOPING

  • Application and architecture review
  • Agreed infrastructure and source scope
  • Technical and executive reporting
  • Scheduled remediation verification

Testing cadence, team and compliance evidence are scoped individually.

Discuss TOTAL

06 — Before testing

Agree the contracting party, NDA where required, written scope, test accounts, authorisation, timeline and escalation contact.

07 — Deliverables

Reproducible PoC with reported findings, impact and remediation guidance, executive summary, technical walkthrough and documented limitations.

08 — Verification

DEEP and TOTAL include retesting of reported issues within the agreed scope and window. Additional features or new assets are scoped separately.

09 — Continuing work

Release checks and recurring assessment programmes can be scoped with a defined testing allocation, asset list and reporting cadence.

10 — Contact

info@vigilcontinuum.com · vigilcontinuum.com

View the sample report ·

Scope your next assessment

Discuss the application, user roles and release timeline. Get a written scope and quote before testing begins.

Request a scoping call