Find what the internet can see
Covers: up to 10 listed domains or public IPs.
You get the approved asset list, what is exposed on it, what to fix first, and one technical call.
Security assessments
Security assessments, from one domain to your whole environment.
We assess the systems your business depends on, explain the biggest gaps, and hand your team a plan with dates. Cloud, application, device, and recurring reviews can be added when they change the answer.
Small-practice entry options
Start with one domain.
Small practices and offices can start with a single domain: a free check, a $149/month monitoring service, or a one-time $750 report. No logins, no software to install. The free check reads public DNS records and shows three observations. Domain Monitor compares those records every month and sends a short summary. The $750 report adds a professional's interpretation, prioritized fixes, and one recheck within 30 days.
The flagship assessment
KernelHawk Baseline.
Choose this when leadership needs an answer it can defend and IT needs an ordered plan. Up to 25 listed systems, from $12,500.
Recommended starting point
Know where you stand.
We review the five areas. You get the score, both reports, one results meeting, 90 days of portal access and verification of up to five fixes.
Focused assessments
Go deeper where the risk or decision demands it.
Buy a focused review when you already know which system, release, account, or suspected weakness needs attention.
Review a business-critical service
Covers: one repository up to 100,000 non-generated lines or one deployed application/API.
Whether we test the running system, and whether we log in, is written into the scope before we start.
Review one signed application release
Covers: one Android or iOS release on one platform.
Runtime, backend, and second-platform work require separate scope.
Check high-impact cloud settings
Covers: one account or tenant and up to 250 listed resources.
The review reads your cloud configuration and leaves it unchanged.
Analyze compiled software
Covers: one artifact up to 500 MB.
Includes static analysis, the evidence register and a results call. Running the software is separate.
Review one model and release
Covers: one device model and one firmware version.
Hardware, destructive, radio, protocol, and additional-release work is quoted separately.
Prove the fix worked
Covers: up to five previously reported findings in the unchanged target and method.
Additional findings are $350 each. New discovery requires new scope.
Choose the engagement
Three clear buying paths.
Each proposal states what is included, who needs to participate, what you will receive, the schedule, and the fixed fee before work begins.
A complete starting picture
Best when the organization has never had an independent assessment, the environment has changed, or leadership needs priorities for planning, insurance, or customer conversations.
Five-area score + action planOne important system or question
Best when a specific application, cloud account, device; public surface, reported issue, or completed fix needs specialist review.
Defined target + technical answerKeep the baseline useful
Best when systems change regularly and leadership wants scheduled exposure review, remediation tracking, retesting, and trend reporting.
Monthly or quarterly reviewWhat sets the price
How many systems, how deep we go, what access we need, and whether a retest is included.
What the proposal states
Systems, methods, what you supply, dates, deliverables, exclusions, retest terms, fee.
What does not happen
Any extra testing, system or charge needs a scope change we both sign.
Published minimum, fixed proposal
One-domain options are invoiced directly. Everything else starts with a written proposal; we invoice after it is signed. The pricing page lists starting prices and what they cover. Your proposal states the final fee, included work, data retention, and support before you commit.
Common questions
What buyers usually want to know.
How are results delivered?
Authorized customers receive leadership and technical reports plus a customer portal where they can see the score, findings, and progress on fixes. Customer sign-in.
Will you start testing when I submit the form?
No. The first step is a conversation. Any security testing requires a separate written scope and authorization from the organization that owns or controls the systems.
Do we receive both business and technical detail?
Yes. Baseline work includes a concise leadership view and a technical findings register. Focused reviews state their exact deliverables in the proposal.
Can you help after the report?
Yes. Remediation planning, implementation support where appropriate, and post-fix verification can be included or added as a separate engagement.
Is the score a certification?
No. It is a dated summary of the agreed scope across five areas. Where a law, regulator or framework requires a formal audit, that audit is a separate exercise.
Can we buy one focused assessment?
Yes. We recommend starting with the KernelHawk Baseline, but a known application, cloud account; device, exposure, or retest can be scoped on its own.
What is the difference between Domain Monitor and KernelHawk Watch?
Domain Monitor is a $149 monthly comparison of public DNS and configuration records for one domain. The review makes no customer-origin request and uses no credentials. KernelHawk Watch starts at $4,500 per quarter for broader scheduled exposure, remediation, and verification work. Neither provides around-the-clock monitoring or emergency response.
Software tools
ThreatWing is KernelHawk's software tool set: the ThreatWing Tools iPhone app (in pre-release) and the hosted ThreatWing Decompiler beta. Learn about their availability at threatwing.com.
Talk through your priorities
Start with the smallest assessment that answers the question.
Tell us what the business depends on and what changed. We will scope the smallest engagement that answers it.
Request an assessment