VUNVAULT combines manual, human-led penetration testing with continuous automated attack-surface reconnaissance. Every engagement is delivered under a mutual NDA, mapped to the compliance frameworks your regulator actually audits against, and handed back with remediation steps your engineers can ship.
Three free lookups powered by the same enumeration engine behind our paid assessments. No account, no commitment, nothing stored.
Resolves reverse DNS, WHOIS ownership and geolocation for a domain or IPv4 address.
Simulated reconnaissance for demonstration purposes. Never query systems, addresses or device identifiers you do not own or have written authorisation to investigate.
Each engagement is scoped, executed and reported by a named lead analyst — never a fully automated scan dressed up as an assessment.
Manual testing across the OWASP Top 10 — injection, authentication and session flaws, broken access control, SSRF and insecure deserialisation — plus targeted parameter fuzzing and business-logic abuse that scanners never reach.
Subdomain enumeration, certificate-transparency mining, SSL/TLS certificate tracing and service fingerprinting — surfacing the shadow IT, forgotten staging hosts and unmanaged APIs that quietly widen your perimeter.
We attack your defences the way an adversary would: rule-evasion encoding, rate-limit and anti-automation validation, payload stress testing and bypass chains that prove whether your WAF, CDN or bot-management layer actually blocks what it claims to.
When something is broken and nobody can explain why: DNS diagnostics, record-consistency audits, connectivity tracing, MTU and routing faults, firewall rule review and misconfiguration hunting across hybrid estates.
API gateway configuration reviews, cloud IAM and storage exposure checks, mobile application testing (Android & iOS) and dedicated M-Pesa / fintech integration audits covering callback validation, replay protection and settlement integrity.
Executive briefing decks for the board, developer-ready technical remediation guides for the engineering team, and audit evidence packs mapped to GDPR, ISO 27001, ODPC and Central Bank supervisory requirements.
Every tier below lists exactly what is tested, what you receive and how long it takes. No hidden line items, no vague "from" pricing.
For a single web application, micro-site or lightweight API endpoint that needs a fast, honest read on its exposure.
For growing SaaS platforms, e-commerce storefronts and active Web APIs where automated scanning alone leaves real risk on the table.
For enterprise applications, fintech and M-Pesa integrations, and SACCO platforms that need regulatory sign-off before go-live.
For multi-domain infrastructure that needs continuous threat monitoring rather than a point-in-time report.
All tiers include encrypted report delivery, a named engagement lead and a rules-of-engagement document signed under mutual NDA. Prices exclude applicable taxes. Re-test windows are measured from the date the final report is delivered.
Send us your target scope, compliance deadline and preferred timeline. We reply with a written scope, rules-of-engagement draft and a fixed quote — usually within one business day.
NDA on request · Scope before invoice · No data retained