Find the way in before someone else does.
Bastion runs penetration tests, 24/7 managed detection and incident readiness for companies of 50 to 2,000 people. Senior testers, plain-English reports, and a fix list your team can actually finish.
Protecting teams in finance, healthcare, SaaS and manufacturing
Most breaches start with something boring.
Not zero-days. A forgotten server, a reused password, a portal without MFA. The gap is usually visible from the outside if someone bothers to look.
involve a human element
Phishing, stolen credentials or a simple misconfiguration were part of the chain.
average time to identify
Without monitoring, attackers sit inside a network for months before anyone notices.
of our first tests find a critical
Usually an exposed admin panel, unpatched VPN or default credentials on a device.
Illustrative figures for demo purposes, based on the kind of industry breach reporting security firms cite.
Offense, defense and a plan for the bad day.
Use one service or combine them. Every engagement ends with a prioritized fix list and a walkthrough with your team.
Penetration testing
Senior testers attack your external network, web apps, cloud and internal environment the way a real adversary would, then show you exactly how they got in.
- External & internal network
- Web app & API (OWASP)
- AWS / Azure / M365 config
- Free retest within 90 days
Managed detection & response
Our SOC watches endpoints, identity and cloud logs around the clock. When something fires, an analyst investigates and contains it, then calls you.
- 24/7 human-led SOC
- EDR + identity monitoring
- Host isolation in minutes
- Monthly threat report
Phishing & social engineering
Realistic phishing, vishing and pretext campaigns tailored to your company, followed by short training for the people who clicked.
- Custom phishing campaigns
- Phone pretext tests
- Department-level results
- Micro-training modules
Incident readiness & vCISO
Incident response plans, tabletop exercises and a fractional CISO who helps leadership answer customer questionnaires and audit requests.
- IR plan & playbooks
- Executive tabletop exercise
- SOC 2 / ISO 27001 readiness
- Board-level reporting
What's your security risk score?
Eight questions, about three minutes. You get an indicative score and the top gaps to close first. Nothing leaves your browser.
Your top gaps appear here as you answer. Higher score means more exposure.
Review my results with an expertIndicative self-assessment only, not a security audit. A real assessment requires testing your environment.
A typical penetration test, start to finish.
Most external tests run two to three weeks from kickoff to report.
Scope call
We agree targets, rules of engagement and testing windows. You sign off before anything is touched.
Recon
We map what an attacker sees: domains, exposed services, leaked credentials, staff footprint.
Testing
Manual exploitation by senior testers. Critical findings are reported the same day, not at the end.
Report & retest
Executive summary, technical detail and a fix list. We retest free once you've patched.
"Bastion found a staging server we'd forgotten existed, with production data on it. The report was the first one our board actually read cover to cover."
"Their SOC isolated a compromised laptop at 2:40am. We found out over coffee."
IT Director, regional health network"We passed our SOC 2 audit on the first attempt with their vCISO."
COO, B2B SaaS, 180 staffClear starting prices.
Final pricing depends on scope. You get a fixed quote after the consultation, never an hourly surprise.
External pen test
Up to 32 external IPs and your primary web app.
- Recon and manual exploitation
- Executive + technical report
- Free retest within 90 days
Managed detection
24/7 SOC with containment, 100-endpoint minimum.
- EDR licensing included
- Identity & M365 monitoring
- Quarterly threat review
vCISO retainer
A senior security lead, roughly two days a month.
- Policy & compliance roadmap
- Customer questionnaires
- Annual tabletop exercise
Book a 30-minute call with a security lead.
No sales script. We'll look at your risk score, ask what keeps you up at night and tell you honestly whether you need us.
- 00:05Your environment and recent incidents
- 00:15What we'd test or monitor first
- 00:25Rough scope, timeline and price range
All calls are covered by mutual NDA on request.
Questions security leads ask us
Will testing disrupt our production systems?
Who actually does the testing?
Do you work with our existing IT provider or MSP?
Can you help with SOC 2, HIPAA or cyber-insurance requirements?
What if we're under attack right now?
Know your exposure by next week.
Start with the free risk score or book a call. Either way, you'll leave with something useful.
Book a consultation