LaiSecure.

Outsourced Security Testing and Scans

A site that is live gets scanned by automated tools continuously, and that has nothing to do with how big the company is. Security testing means using the same methods before an attacker does, finding the gaps you cannot see from the inside, and deciding which one to close first.

When testing is worth buying

Almost nobody arrives here because security came to mind on its own. Something happened first. Each of the situations below is a reasonable moment to run one assessment and see where you actually stand.

Check yourself

  • Your site has accounts, orders or forms, so it holds customer data, and nobody has ever checked how well that is protected.
  • A client or an auditor has asked for a security assessment report, with a deadline a few weeks out.
  • You have just redesigned, changed hosts or connected a new system, so the exposed surface changed and nobody re-checked it.
  • A server is showing load nobody can explain, an account nobody created, or antivirus that will not stay on.
  • There is no IT person on staff, and plugin and system updates have gone unattended for a long time.
  • You are an agency or integrator and need to subcontract the security line item on a project.

What the four services actually look at

These get lumped together, but they examine different things at different moments. A web application scan looks at the application layer: logins, forms, parameters, access control, the behaviour you expose to the internet. A host scan looks at versions and configuration: whether the operating system and services carry known vulnerabilities, whether anything is listening that should not be. A health check goes inside the machine and inventories its current state: what is running, who has privileges, which ports are open, what is scheduled. A phishing simulation looks at none of that. It looks at whether people click.

Check yourself

  • Web application scan: checked item by item against the OWASP Top 10, each finding carrying the affected URL and the evidence behind it.
  • Host scan: severity marked with CVSS scores, then reordered by how exposed each finding actually is.
  • Health check: running processes, accounts and privileges, open ports, scheduled tasks and patch status.
  • Phishing simulation: a harmless simulated email, measured for opens, clicks and submissions, broken down by department.

Not knowing which one you need is fine. Most small businesses get everything they need from a web application scan alone. Host scans and health checks usually matter once you run your own server. A phishing simulation suits an organisation that has already decided to work on the human layer.

What the report contains

The report is the actual product here, so it is worth being specific about its shape. A usable report has to work for two readers at once: the technical contact needs to know how to fix each finding, and whoever signs off needs to know what it will cost and how long it will take. A raw export from a tool is not a deliverable.

Check yourself

  • Summary: what was in scope, how many findings, how the risk is distributed, all on one page.
  • Findings: the weakness, its severity, the affected URL or location, the evidence, and a reference.
  • Remediation advice: specific enough to act on, and marked for whether it is a configuration change or something that needs a test window and downtime.
  • Fix order: ranked by real exposure and cost to fix, not copied straight from the severity column.
  • False positives: anything judged a false positive is written up with the reasoning, so you can check it yourself or have a second firm cross-check it.
  • De-identified sample reports are available, so you can confirm the format suits you before commissioning anything.

What you need to provide, and whether it disrupts anything

Every assessment requires written authorisation first, and runs only within the authorised scope. That is not a formality. It is the thing protecting both sides.

Check yourself

  • Web application scan: the URL range to test. If there is a members area, a test account, otherwise the pages behind the login never get scanned.
  • Host scan: the IP range, and confirmation that the scanning source will not be blocked wholesale by the firewall.
  • Health check: administrator access, since processes, accounts and system settings cannot be read without it. The run only reads and inventories. Nothing is changed, deleted or restarted.
  • Phishing simulation: the mail gateway needs to let the simulated messages through, and the scenario and the use of the results are agreed in advance.
  • Load-sensitive systems can be scheduled off-peak or overnight, and scan intensity is adjustable to your environment.

On timing: a single site scan including manual verification and report writing usually takes one to two weeks. A host scan depends on the number of IPs. The health check tool itself runs in minutes; the time goes into interpreting the output. A phishing simulation runs longer because it includes scenario design and the training that follows.

How it is priced, and what to ask before commissioning

The usual sticking point is not knowing what any of it costs, so here is the basis. Web application scanning is priced per URL, host scanning by IP count, health checks per machine, phishing simulations by the number of people tested. All four have published starting prices, in the table below. Real quotes move with scope and complexity, but nothing gets added halfway through.

Prices are in New Taiwan dollars, written NT$. What actually moves the total is scope: one URL and ten subdomains are very different jobs, and so are one server and ten. So the things to be tested get listed before anything is quoted, rather than handing you a vague range to guess against.

Check yourself

  • Ask how scope is counted: per URL, per domain, per IP, per machine? Do subdomains and staging environments count?
  • The first thing to check on a scanning quote is whether manual verification is included. A raw tool export and a report where every false positive has been checked by hand are very different products, and the price gap should be large.
  • Ask whether the report orders the fixes. A list sorted by severity score leaves the hardest judgement with you.
  • Ask whether the re-test after remediation costs extra, and whether you get a record showing the findings were closed.
  • Ask who actually does the work. If you are hiring an engineer, you should know who that is and be able to talk to them directly.

Subcontracting is open to discussion. Agencies, system integrators and marketing firms regularly land projects with a security line item they cannot staff, and hand the testing and report writing to someone else. The report can be delivered under your name, in your existing template. Confidentiality and delivery terms go in the contract.

Pricing

ItemFrom

Web Vulnerability Scan

Scans web-app weaknesses by OWASP Top 10

NT$18,000from / URL

Host Vulnerability Scan

Scans known flaws in OS and service versions

NT$15,000/ 0–10 IPs

Social Engineering

Phishing exercise measuring open, click and submit rates

NT$30,000from / up to 300 people

Host / Server Health Check

For hosts and servers alike (Windows), priced per machine

NT$2,000/ machine

Real quotes move with scope and complexity, and the basis is written out on the quote itself.

What this service does not cover

Settling the scope now beats discovering it does not fit after the work is commissioned.

  • No compliance certification consulting. Preparing you for a management-standard audit is outside the scope. An assessment report can serve as supporting evidence, but it is not the same thing as passing an audit.
  • No source code review and no mobile application testing.
  • No assessment without written authorisation, and nothing is ever run against a system held by a third party.
  • No promise that you will not be breached afterwards. Testing narrows the blind spots and puts the known problems on the table. It cannot claim to take the risk to zero.
  • Assessment and interpretation only, not remediation or cleanup. The report says what was found and how to address it; the actual fixing, malware removal and rebuilding is done by your people or your existing provider.
  • There is no 24-hour incident response rota. Emergencies can be discussed, but the hours are written into the contract.

Common questions

We only have a brochure site. Do we need security testing at all?
It depends on whether you collect anything. A purely informational site with no forms and no login carries its risk mainly in the host and in system updates, so one scan confirming there are no known vulnerabilities is enough. The moment you have accounts, orders, bookings or a contact form, you are holding personal data, and that is worth checking regularly.
Will testing break my site?
Not under normal conditions. Scanning mostly reads and probes, and does not deliberately damage data. But any automated scan raises the request volume, so a system already running near its limits can slow down. The window and the scan intensity are agreed in advance, off-peak or overnight if needed. A health check only reads; it changes no settings.
Can the report go straight to a client or an auditor?
Yes. It contains scope, method, findings, severity and remediation advice, in a format that works as a supporting document. If they have a required format or fields, raise it when commissioning and it will be accommodated where possible.
Does fixing cost extra?
Testing and fixing are separate jobs. The report explains how to close each finding, and your engineer or hosting provider can work from it. If you want me to do the remediation, that is quoted separately. A re-test after the fixes can be included from the start, so you end up with a record showing they were closed.
Can agencies and integrators subcontract this?
Yes. Both the testing and the report writing can be delivered under your name, in your existing template. Terms and confidentiality are settled in the contract.

Read next

Notes written under the same topic, if you would rather work it out yourself first.

Other services