§Levels

Choose the depth of verification

Start with the external perimeter or choose a deeper assessment. All work is remote; scope and final pricing are agreed before testing.

V1 · Surface Verified

The public perimeter, verified automatically.
from$5per product / year
What is verified
  • Domain and DNS
  • HTTPS and TLS
  • Basic external configuration
  • Availability and public perimeter
Not verified at this level
  • Application logic and authenticated areas
  • Source code and dependencies
  • Infrastructure and processes
Duration: 1–2 business days
External perimeter
Submit a product for verification

V2 · Application Verified

The application and its API, tested with real scenarios.
from$149per product / year
What is verified
  • Application
  • API
  • Authentication
  • Authorisation and roles
  • Basic data isolation
Not verified at this level
  • Source code and dependencies
  • CI/CD and build integrity
  • Infrastructure and processes
Duration: 1–2 weeks
Application & API
Submit a product for verification

V3 · Code Verified

Code, dependencies and the delivery pipeline.
from$499per product / year
What is verified
  • Source code
  • Dependencies and CVEs
  • Secrets
  • SAST and SBOM
  • CI/CD
  • Key application and API scenarios
Not verified at this level
  • Cloud infrastructure configuration
  • Organisational processes
  • Continuous monitoring
Duration: 2–4 weeks
Code & dependencies
Submit a product for verification

V4 · Assured

Expert scenarios, infrastructure, processes and continuous monitoring.
from$1,499per product / year
What is verified
  • Expert scenarios
  • Business logic
  • Infrastructure
  • Data isolation
  • Security processes
  • Re-checks and continuous monitoring
Not verified at this level
  • AI/Agent components (available as an add-on)
  • Components explicitly excluded in the scope
Duration: 4–8 weeks
Extended assurance
Submit a product for verification

Starting prices per product per year. Component count, access and complexity determine the final price. Payment for assessment does not guarantee certification.

What is included

V1Surface VerifiedV2Application VerifiedV3Code VerifiedV4Assured
Methodology domainsPerimeterPerimeter, ApplicationPerimeter, Application, CodePerimeter, Application, Code, Infrastructure, Data
Check groups across included domains12263552
Expert scenarios—BasicApplication and API scenariosFull, incl. business logic
Continuous monitoring———
Re-test included
Typical duration1–2 business days1–2 weeks2–4 weeks4–8 weeks
Validity12 months12 months12 months12 months
Required accessesPublic endpoints onlyPublic endpoints only
Temporary test accounts		Public endpoints only
Temporary test accounts
Read-only repository access
CI/CD configuration and SBOM		Public endpoints only
Temporary test accounts
Read-only repository access
CI/CD configuration and SBOM
Read-only cloud access
Process documentation

Levels: V1 covers domain A; V2 adds B; V3 adds C; V4 adds D and E. Domain F is an add-on to any level.

AI/Agent Security add-on

For products that embed language models or agents acting on behalf of users. Adds eight checks on prompt injection, tool authorisation, output handling, data leakage, supply chain, abuse controls and oversight. Available with any level; priced after scope review.

Custom scope

Complex products — several applications, on-premises components, regulated data — get a custom scope assembled from the same catalogue of checks, with the same public rules.

Find the right level for your resource.

Submit a product for verificationDiscuss certification

Free initial assessment · response within two business days