Can you work with our existing development company?

Yes. We can work with your development and maintenance teams to explain findings, discuss remediation and retest fixes. If you need Unimon to implement changes, we agree that scope separately.

Can you assess a production environment?

We review the environment and business impact before agreeing an approach for each engagement. We agree in advance how to handle actions that write data or tests that may cause disruption, and use a test environment where appropriate.

Are remediation and retesting included in the price?

The quote clearly defines the scope of assessment, remediation advice, implementation and retesting. For monthly support, we also agree the systems covered, assessment frequency, work allowance and retesting conditions in advance.

Can we discuss AI systems such as LLM or RAG applications?

We review your system architecture and the risks you want to investigate, then consider the scope individually. Using AI to assess web applications and APIs is a separate scope from assessing the security of an AI system itself.

How do you handle assessment data and confidential information?

Before an assessment, we agree what information is collected, where it is stored, how long it is kept and what may be sent to inference models. If you have requirements such as restrictions on external data transfers or an isolated environment, we review the available configurations and approach individually.

Services

AI finds. People verify.Security that leads to fixes.

Assess vulnerabilities in your web applications and APIs, and understand what to fix first. We combine AI-assisted discovery with human verification, working with your development and operations teams through remediation and retesting.

Discuss testing and remediation

AI finds. People verify.
Security that leads to fixes.

Turn assessment findings into improvements

From assessing existing systems to ongoing improvements, we can discuss the scope and approach that fit your needs.

Check risks before a release or after a change

Identify weaknesses that could realistically be exploited before releasing a new feature or API.

Know what to fix first and how

You have assessment findings, but work has stalled because their impact or the right remediation approach is unclear.

Bring teams in Japan and Thailand together

Help management, local developers and external maintenance providers work from a shared understanding of the fixes and verification needed.

Three ways to help, starting where you need us

An initial assessment, ongoing monthly support or implementation of fixes. Combine services to suit your challenges and existing maintenance arrangements.

AI Security Support

Web & API Vulnerability Assessment

Initial / One-off

We assess the agreed applications and APIs, with people verifying findings and their impact. The report helps you prioritise remediation.

Define target functions, access roles and assessment items

AI-assisted discovery with human verification

Report evidence, impact and remediation guidance

Quoted against an agreed assessment scope

Security Improvement Support

Monthly / Ongoing

Combine periodic assessments, checks on changed features and remediation advice to keep addressing weaknesses as development progresses.

Assessments at agreed intervals and after agreed changes

Track unresolved findings and discuss fixes

Retest fixes and share improvement status

Monthly agreement with a defined scope, frequency and work allowance

Remediation & Critical CVE Support

Fixes / Updates

We help update code and configuration, assess exposure in software such as PHP, and plan upgrades. We also check that normal functionality continues to work.

Support code, configuration and dependency fixes

Assess critical CVE exposure and agree an update approach

Share remediation pull requests, change procedures and verification results

Within an existing maintenance agreement or quoted separately

Define what to check, including functions and permissions

We select assessment items based on your application architecture and business impact. The report records the scope, completed checks and areas not tested.

Authentication & access control

Use login flows and accounts with different roles to check paths that could allow unauthorised access to information or actions.

Input & file uploads

Review how external input is handled and where files are stored to identify weaknesses that could lead to injection or unintended code execution.

APIs & business workflows

Check API access controls and functions involving several connected actions in the context of your business workflows.

Software & configuration

Review dependencies and runtime information to identify known vulnerabilities and components that need updating.

We review production and test environments, authentication, external integrations and business impact before agreeing the assessment method and scope.

Understand the findings and how to address them

Get a summary for business decisions and technical details developers can use to implement fixes.

Executive summary

A concise account of verified business impact, remediation priorities and outstanding issues.

Technical report & supporting evidence

The target, conditions under which the issue occurs, evidence from requests or output, and the scope tested and not tested.

Remediation guidance & action list

Causes and proposed fixes, shared in a format development and maintenance teams can use to track progress.

Retest results

Verification results and remaining issues, clearly identifying where further action is needed.

A quote tailored to your systems and support needs

We propose initial assessments, monthly support and implementation work separately. Start by telling us about your systems and the challenges you face.

Applications, APIs and key business workflows
Roles, tenants and authentication methods
Target environments and external integrations
Assessment frequency, remediation support and retesting scope

Delivery dates, fees, retesting periods and frequency, and monthly work allowances are agreed in advance after reviewing the scope.

From the first discussion to remediation and retesting

Agree the scope and conditions before testing, then turn findings into work your development and operations teams can act on.

Understand the scope and conditions

Review your systems, environments, test accounts and priorities. Agree authorisation, testing windows, contacts and data handling.

Plan the assessment and provide a quote

Define target functions and roles, assessment items, deliverables, remediation support and retesting scope.

Explore and verify findings

Use AI and assessment tools to explore, with people checking the evidence and impact. Share critical findings through the agreed communication channel.

Report findings and support remediation

Explain business impact and technical causes, and discuss how to address them. Support code or configuration changes where needed.

Retest and share the status

Verify behaviour after fixes within the agreed scope, distinguishing resolved, remaining and unverified findings.

Bring development, operations and language support to remediation

People verify the evidence and impact

We do not pass AI output straight into a report. Our team checks findings and evidence to help identify the actions that matter most.

Work with your developers and maintenance providers

We can work with your existing development company. Combine remediation advice and implementation support to match the help you need.

Explain findings to teams in Japan and Thailand

Reporting and discussions are available in Japanese, Thai and English. We agree the reporting language and meeting format to suit your team.

Frequently asked questions

Answers about assessments, remediation and the scope of support.

From assessment to getting fixes moving.

Tell us about your web applications and APIs, your development and maintenance arrangements, and your concerns. We will propose an assessment and support scope to match. The initial consultation is free. We provide a quote after confirming your systems and requirements.

Discuss testing and remediation View Portfolio