When does testing start?

After the owner of the system signs a scope letter: the targets, the dates, the contacts and the systems that must stay untouched. Testing starts once that letter is signed.

What do we get after a security audit?

A written report: what we found, how dangerous it is, and what to fix today, this month or later. It comes with a short plain-language version for the owner and the technical detail in an appendix.

Who fixes the problems you find?

We fix them ourselves or together with your contractor. Then we check again and confirm that each finding is closed.

How do you use AI in this work?

Our team works from its own experience with strong tooling to find problems faster. A person checks every finding before it reaches your report. Tools and AI models are used within their providers' rules, and client data is covered by a confidentiality agreement.

Cybersecurity: finding and fixing security risks

What you get

We find and close security gaps in the websites, servers and office IT of small and mid-sized businesses: a check, a report in plain language, the fix, and a second check to confirm it.

You pay for a result: closed vulnerabilities, a clean server, a report, documents ready for an auditor.

Five services and what you receive from each

1. Website and server security audit

We check the external perimeter, the CMS and its plugins, hosting control panels, TLS and security headers, DNS and mail (SPF, DKIM, DMARC), access rights and MFA, and backups.

You receive: a written report on what we found, how dangerous it is, and what to fix today, this month or later, plus a short plain-language version for the owner.

2. Penetration testing of web applications and the external perimeter

We test only with written permission from the owner of the system, against agreed targets and within an agreed time window.

You receive: a report with reproducible findings and evidence, a remediation plan, and a free re-test of the fixes within the same scope.

3. Incident response after a breach

We find malicious code and web shells, establish how the attacker got in and what leaked, close the entry point and restore the system.

You receive: a clean site or server, the entry point closed, passwords and keys changed, a backup verified by a test restore, and a report on how they got in, what was affected and what we did.

4. Hardening and remediation

We fix what the audit found: updates, server configuration, permissions, MFA, backups with a tested restore, and monitoring.

You receive: a completed checklist of measures with every item marked, a verified restore from backup, MFA switched on, and alerts configured.

5. Preparation for ISO/IEC 27001 and CyberSecure Canada

Policies, a risk register, the Statement of Applicability (SoA) and an internal audit.

You receive: the document set (policies, risk register, SoA), a completed internal audit, and a list of what remains before the certification audit.

Website security services in detail

Each page below covers one job on a business website: what we do, what you receive, what we need from you and where our work ends.

Hacked website repair: malware and web shell removal, the entry point found and closed, keys rotated, a restore tested.
Remove a Google "Deceptive site ahead" warning: the flagged content cleaned and the Search Console review request filed.
WordPress security: plugin and theme audit, hardening, two-factor login and tested backups for business WordPress sites.
Website security audit: CMS, plugins, server, TLS, headers, forms, access and backups checked by a person, with a prioritised report.
Website security monitoring: alerts on file changes, new admins, certificate expiry, blocklists and DNS, sent to a named person.
DMARC setup and email domain protection: SPF, DKIM and DMARC moved step by step to enforcement, so receiving servers can reject mail forged in your name.
PCI DSS 6.4.3 and 11.6.1 for online stores: payment page script inventory, integrity controls and weekly change detection.
GDPR website security requirements: Article 32 measures for forms, hosting, plugins and backups, with the evidence written down.
DDoS and bot protection: CDN and firewall in front of the site, rate limits and bot rules for logins, forms and checkout.

How we work

1. Agree the scope. A short call or the contact form: we decide together what gets checked.

2. Scope letter. Before any test, the owner of the system signs written permission with the targets, dates, contacts and the systems that must stay untouched. Work starts after the signature.

3. Check and report. A report in plain language, with the technical detail in an appendix.

4. Fix. We fix the findings ourselves or together with your contractor.

5. Re-test. We check again and confirm that each finding is closed.

We do the work and hand you the result. Our team uses its own experience and strong tooling to find problems faster. Every finding is checked by a person before it reaches your report, and we fix what we find.

Who signs the contract

Security engagements are contracted with INNOVA CONSULT LTD., Ottawa, Ontario (Corporations Canada, Corporation Number 1522612). Tools and AI models are used within their providers' rules. Client data is covered by a confidentiality agreement.

Cost

Each engagement gets a fixed estimate once the scope is agreed.

Setting up servers, mail and backups from scratch: turnkey IT infrastructure. Building the site itself: corporate websites. To agree what gets checked, write to us.

Maksym Stepanenko, founder of Marketing MIX. Last reviewed: 2026-09-25.