Security Risk Score
Assesses the digital exposure risk of an online product or service and compares it with other companies in the same sector.
Needs: a domain
Digital risk assessment
Find the vulnerabilities before someone exploits them.
Automated cybersecurity tests on your website, online shop, app and APIs, with reports that combine artificial intelligence with analysis by specialists. You learn what is exposed, what is urgent and what to do next.
- Automated tests, nothing to install
- Technical report and executive summary
- Guidance from a consultant
The risk
Small and medium businesses are the easiest target. And they know it less than they should.
They lack risk identification tools, specialist support and time. Attackers know it: an outdated website, a reused password or an email domain without DMARC is enough to get in.
Modern ransomware encrypts tens of thousands of files in minutes. The time to act is before, not after.
What an assessment usually finds
- CMS, plugin and server versions with known vulnerabilities
- Admin panels and services exposed for no reason
- Misconfigured or expiring certificates
- Email domains that anyone can impersonate
- Employee passwords for sale on criminal forums
Available tests
Choose the right test for each risk.
Each test runs automatically from a domain, an IP address or a code repository. Before we start, we tell you exactly what is needed.
Automated Penetration Testing
Continuous penetration tests, with bots and artificial intelligence simulating typical attacker behaviour in real-world scenarios.
Needs: a domain or IP address
Vulnerability Mapping
Checks against reference vulnerability catalogues, updated regularly, to detect known security flaws.
Needs: a domain or IP address
Code Analysis
Analyses the source code of websites and applications to find security flaws: exposed credentials, vulnerable open source components and more.
Needs: a repository (ZIP or GitHub link)
Credential Monitoring
Watches your company's email addresses 365 days a year and alerts you when credentials show up on the dark web and criminal forums, from phishing or infostealer malware.
Needs: an email domain
Maturity Assessment
Eleven questions, five minutes, and a simplified assessment of your company's cybersecurity maturity, with recommendations you can put into practice.
How it works
From test to fix, in three steps.
We choose the tests with you
Based on what you have online and what concerns you most. The tests run automatically, with nothing to install and no downtime.
You get a clear assessment
A technical report detailing each vulnerability, and an executive summary with what is critical and the measures to take now.
You fix it, with or without us
Hand the report to your team or your IT provider, or ask us for help. Once fixed, we run the test again to confirm.
What you get
Two reports: one for whoever fixes, one for whoever decides.
Technical report
Every vulnerability found, with its severity, the affected component, the evidence and how to fix it. For the IT team or the supplier that maintains the system.
Executive summary
Generated with artificial intelligence and reviewed by our specialists. It highlights the most critical vulnerabilities and the short-term mitigation measures, in management language.
Maturity assessment
Eleven questions to see where your company stands.
Answer honestly: nobody sees the answers but you. The result appears on this page and is not sent anywhere, unless you ask us to talk about it.
Questions
Frequently asked questions.
What can I test?
Digital products and services available on the internet:
- your website
- your online shop
- your app
- your APIs
Every test looks for vulnerabilities, so you can fix them before someone takes advantage of them.
What is needed to run a test?
It depends on the test: a domain, an IP address or a code repository (ZIP folder or GitHub link). Before each run we tell you which details are needed, and a consultant guides you throughout.
Can the tests take my website down?
The tests are designed not to disrupt the service. We agree the schedule and limits with you before starting, and we only test systems you own or have written authorisation to test.
What do I get after each test?
Two reports: a technical one detailing the vulnerabilities found, and an executive summary, generated with artificial intelligence and reviewed by our team, highlighting what is most critical and the short-term measures to take.
Does this help with NIS 2 compliance?
It helps. The NIS 2 Directive calls for risk management, testing of the effectiveness of security measures and attention to the supply chain. The reports serve as evidence that you identified and addressed the risks. On their own, they do not replace a compliance programme.
I am an IT service provider. Can I use the tests with my customers?
Yes, and that is what the partner programme is for: tests at scale, reports to hand to your customers and a new line of business in remediation.
Request a quote
Request an assessment
Tell us what you have online and what concerns you most. We propose the right tests, at a fixed price, within one business day.
Prefer to talk? +351 210 205 164
weekdays, 9:00 to 18:00 Lisbon time
By email: support@sooma.com