Cybersecurity

Security Assessments

Identify Risks, Build Resilience

Security audits and vulnerability assessments.

Secure Your Business

Key Capabilities

What Security Assessments Delivers

Vulnerability Scanning & Penetration Testing

Security Architecture Review

Compliance Gap Analysis (ISO 27001, GDPR)

Application Security Testing

Network Security Assessment

Security Roadmap & Remediation Plan

What a security assessment costs

Clear ranges so you can plan a budget before the first call. Pick the tier closest to your situation.

Essential

A focused assessment for a small organization.

$2,500 to $6,000

one-time project

Get a fixed quote
Best fit for most organizations

Standard

A full assessment across network, identity, cloud and policy.

$8,000 to $20,000

one-time project

Get a fixed quote

Enterprise

An ongoing programme with remediation support.

From $25,000

one-time project

Talk to an expert
  • A range becomes a fixed price after a short scoping call. What moves a price: users and departments, data to migrate, integrations, and how much is configured versus built.
  • Optional annual support and managed governance starts at 18% of the project value per year (minimum $1,800). Changes after go-live are $85 per hour, or a prepaid 20-hour block for $1,600.
  • Prices exclude VAT (16% in Kenya) and withholding tax.

Not sure which fits? Tell us your team size and what you use today and we will point you to the right option.

Who this is for

  • Regulated institutions required to demonstrate a security posture rather than assert one.
  • Organizations handling personal data under the Kenya Data Protection Act or equivalent obligations elsewhere.
  • Anyone who has grown quickly and whose security arrangements have not been reviewed since they were much smaller.
  • Organizations that have had an incident or a near miss and need an honest picture rather than reassurance.

What a security engagement covers

Scoped to what you need to know and what you are able to act on. An assessment producing a hundred findings nobody can address is a report, not an improvement.

  • Security assessment against your estate, identity, endpoints, network, cloud configuration and data handling.
  • Penetration testing where you need adversarial validation rather than configuration review.
  • Compliance audit against the obligation that applies to you.
  • Data protection review, including the practical question of whether you could answer a subject access request.
  • DPO-as-a-Service where you need the function without a permanent hire.
  • Remediation planning that is prioritized and sequenced, rather than a list sorted by severity with no regard to effort.

How the engagement runs

  1. 1

    Scoping and authorization

    What is in scope, what testing is permitted, and written authorization before anything is touched. This is not a formality.

  2. 2

    Assessment

    The work itself, conducted to avoid disruption to production, with anything critical reported immediately rather than held for the final document.

  3. 3

    Reporting

    Findings with evidence, business impact and a realistic remediation path, written so an executive can act on it and an engineer can implement it.

  4. 4

    Remediation support

    Where you want it, help fixing rather than only finding. Retesting confirms what was actually closed.

What you need in place

  • Written authorization from someone with authority to give it. We will not test without it.
  • An agreed scope and rules of engagement, including systems that must not be touched.
  • A technical contact available during testing.
  • Realistic intent to remediate. An assessment commissioned only to satisfy a checklist produces a document and no improvement.

Working with Sibasi on security

What is the difference between an assessment and a penetration test?

An assessment reviews configuration, policy and architecture against good practice and applicable obligations, broad, and good at finding systemic weakness. A penetration test attempts to exploit, which validates whether a weakness is genuinely reachable and what it would yield. They answer different questions and most organizations benefit from the assessment first, since a test against an estate with obvious configuration gaps mostly confirms what a review would have found more cheaply.

Will testing disrupt our systems?

It is scoped not to, and rules of engagement set out what is off limits and when testing may run. Any activity carrying genuine risk of disruption is agreed explicitly beforehand rather than assumed acceptable. Where a system is too critical to test in production, we say so and propose an alternative rather than proceeding and hoping.

What do we get at the end?

A report with findings, the evidence behind each one, the business impact in terms a non-technical executive can act on, and a remediation plan prioritized by risk against effort. A list of two hundred findings ranked purely by severity is not actionable, and we would rather deliver something your team can work through than something that looks thorough.

Can you help us fix what you find?

Yes, and many clients want that. Where we do, retesting confirms what was genuinely closed rather than what was reported as closed. Some organizations prefer separation between assessor and remediator for independence reasons, which is a legitimate position and one we will work with.

Let's put Security Assessments to work for you

Talk to our specialists about your goals, timeline and budget.

Talk to an Expert