Straight answers before we start.

Every plan includes a signed written scope, a review of the predefined domains and login roles in that scope, and a prioritized report mapped to OWASP standards. Each finding shows what is wrong, why it matters, the proof, and what to change—plus an 'Observed, Not Tested' list of external links we spotted. You also get Q&A support while your team fixes, one complimentary re-scan within 45 days (60 days on Infrastructure), and a signed 1-page Letter of Attestation once the re-scan finishes.

Yes. In addition to traditional web and API vulnerabilities, we test the AI features you have built into your site or product. That includes checking whether User A can prompt a RAG assistant into quoting User B's documents, testing whether tool-calling agents can be tricked into running staff-only actions, testing indirect prompt injection through forms and uploads, and checking for exposed LLM API keys or unthrottled endpoints that attackers could drain.

No. We find, prove, and explain what to change, and your developers or agency make the fixes. Keeping the review separate from the repair keeps our assessment independent for compliance and audit purposes. If you don't have someone in-house to make the fixes, we are happy to introduce trusted development partners.

Once your team finishes their fixes—anytime within 45 days of the initial report (60 days on the Infrastructure plan)—tell us in the portal and we re-test the exact same scope at no charge. We deliver an updated report marking every finding Closed or Still Open with fresh evidence, along with your 1-page Letter of Attestation.

Yes. You can read a full single-client report excerpt on our Sample Report page (/report) or download the 4-page PDF brochure and sample report directly from the site to share with your team.

Never. In fact, we do not maintain a training dataset at all. We run our own open-weight models whose weights we modify directly for security testing, and our reviewers edit the system logic and prompts by hand based on human security findings. Your source responses, credentials, files, and findings are used solely to produce your report and are never fed into any model training pipeline.

Commercial frontier models are tuned to be polite, general-purpose assistants, and sending client traffic through third-party consumer APIs raises data-handling questions. We run our own open-weight models in isolated environments, modify their weights directly for security analysis, and pair them with testing logic and prompts we edit by hand after engagements. They focus on one job—mapping permissions, chaining small flaws, and testing business and AI logic—while keeping your data under our roof.

A traditional scanner checks a static list of known software versions and CVEs, then dumps hundreds of unverified warnings on your desk. Our models sign in as each role you provide, follow multi-step workflows, test whether one customer can reach another customer's records or AI context, and verify every finding with concrete proof before a human reviewer signs off.

The goal is the same—find what an attacker would exploit before they do—but the economics are different. Checking every role combination, API parameter, and forgotten route by hand used to require weeks of expensive consultant hours. Offloading that patient, repetitive exploration to our modified security models lets small and mid-size businesses get deep, human-verified testing for a flat, published price.

We never push on or probe any domain that is not explicitly listed in your signed scope. An outbound scope filter restricts our models to your predefined domains. However, when our models see outgoing links, redirects, or script references to other hosts—like an internal ERP login, an old subdomain, or a third-party vendor—we list them in an 'Observed Outside of Scope (Not Tested)' section of your report so you know they are reachable from your site.

We combine human setup at the start with strict technical guardrails during the run. Before testing begins, a human reviewer configures rate limits and marks sensitive actions (like billing, account deletion, or mass email endpoints) off limits. During testing, discovery and read checks run autonomously, while state-changing requests (creates, edits, deletes) are restricted to canary test records created under the test accounts you provided. We also monitor response latency and error rates automatically so testing throttles immediately if your server slows down.

No. We test your systems from the outside and from inside the test logins you provide, the same way a real attacker or curious customer interacts with your application. You don't need to grant repository access or install any agents on your servers.

Either works. Perimeter checks (Site plan) almost always run against your live domains so we see your real DNS, certificates, and public files. For authenticated application testing (Application and Infrastructure plans), we can test against staging, production with dedicated test accounts, or a mix of both—whatever fits your setup best.

We don't wait until the end of the week to tell you. If we find an urgent exposure—like an open database backup or an unauthenticated admin endpoint—we alert your primary contact immediately through the client portal and by email so you can close it that day.

Yes. Because we do not perform remediation work ourselves, our review is an independent third-party assessment. Findings are mapped to recognized standards (OWASP WSTG, OWASP API Top 10, OWASP LLM Top 10, and PTES), and after your complimentary re-scan we issue a signed 1-page Letter of Attestation. That letter states the scope, dates, methodology, and verified remediation outcome—giving your customers, insurers, and auditors the proof they need without forcing you to hand over raw vulnerability details.

Through our encrypted client portal (/portal), never by email. When your engagement is scheduled, we send you a one-time invite link. Every URL, username, password, and note you add is encrypted with AES-256-GCM before it touches the database. Once your complimentary re-scan is complete, we recommend revoking the test logins, and we automatically purge remaining credentials from the portal 14 days after the engagement closes.

We operate across North America with offices in the United States (New York, NY) and Canada (Toronto, ON). US clients contract with Raven Security LLC in USD, and Canadian clients contract with Raven Security Inc. (with invoicing available in USD or CAD).

Most Site and Application reviews begin within a few business days of a signed scope and deliver the initial report within 5 to 7 business days. Infrastructure reviews typically take 7 to 10 business days. Your fix window and complimentary re-scan then run on your schedule within the 45- or 60-day re-scan window.

We offer clear add-ons—+$1,500 for an AI & Agent Feature Deep-Dive on Site or Application (already included in Infrastructure), and +$750 per 2 extra login roles or 3 extra hosts. If your environment is larger than Infrastructure allows, tell us what you run and we will give you a fixed price in writing before any work starts.

No one honestly can. Software changes, new vulnerabilities appear, and no point-in-time review can prove the absence of every flaw. What we guarantee is a disciplined, thorough review of your agreed scope, verified proof for every finding, a complimentary re-scan to confirm your fixes, and zero surprise billing.