Scope
One host and one external ingress, named in a written authorization. We do not see your source, your cloud console, or your internal network.
Authorized external testing
See your host the way an attacker would.
Observ runs a contained agent against one host you authorize. You get a report of what it found, with evidence. The clone is destroyed when the run ends.
01 host
01 ingress
00 persistence
The offer
One authorized host. One run. A report you can act on.
A fixed scope keeps the test honest and the price flat. No hourly table, no growing surface area, no surprise invoice.
Run
An agent reconnoiters the ingress, investigates what it finds, and records only what it can prove. A finding without evidence does not count.
Report
A ranked list of findings with severity, location, and the request that demonstrates each one. Delivered as a document you keep.
$3,995Per host, per run
Deposit reserves a window. A signed scope starts the run.
The run
From a hostname to a report, in one controlled pass.
The agent starts with one address and nothing else. It cannot see the runner that scores it, the answer key, or anything else on the machine.
01
Authorize
You sign the host, the window, and the rules.
02
Isolate
We boot a disposable clone of the target. Nothing else is touched.
03
Recon
The agent maps what is exposed on the single ingress.
04
Probe
It investigates within policy and attaches evidence to every finding.
05
Report
Findings are normalized, scored, and written up.
06
Destroy
The clone and the run environment are torn down. Nothing is left running.
Runner
The agent
Sees one address. Holds no answer key.
Target
One host
A disposable clone of the host you authorized.
The only path between them is the ingress you approved.
Scope
We turn down work that should not be run.
The gate is written authorization. If we cannot see it, we do not start.
Not a fit
- No written authorization for the host.
- A third party you do not control.
- A request for exploit code or a weaponized payload.
- A live system you cannot isolate or schedule a window for.
What we need
- Hostname and port.
- Authorization contact and signature.
- A window for the run.
- A staging clone, or a signed acceptance of production risk.
Evidence
A finding is a claim you can check.
Every entry in the report carries the same fields, so your team can reproduce it and act on it. No evidence, no finding.
OBS-0417
HIGH
Administrative interface reachable on the public ingress
Class
Exposure
Target
host.example.com:443
Evidence
HTTP 200 on the admin path with no authentication challenge. Raw response captured.
Status
Confirmed. Report only. No action taken against the host.
Book the test.
One host, one run, $3,995. Tell us the host and the window, and we will confirm scope.
Book a test
Deposit reserves a window. Written scope starts the run.