for vc funds & accelerators

One security program for your whole portfolio.

Every portfolio company under one signed, continuous coverage. One posture report across the batch, diligence that does not cost a deal.

from €9,900/yr

list price per company; the portfolio price sits below list, in writing

2–3 days

intensive hunt after every company-approved release

24/7

overwatch between releases, so nothing ships unwatched

What each company gets

The standing hunt, applied per company.

  • Continuous testing of the external web and API surface, retested after every release.
  • A human verifies every finding with a working proof of concept and signs every report.
  • One flat group rate, no meter running in the background.

What the fund gets

A portfolio posture report per cycle: every company, its findings by severity, its top risks, when it was last retested. A named analyst. Co-branded evidence for LPs and diligence rooms, no call in between.

Portfolio postureCycle 07 · signed
CompanyFindingsRetest
app-a.example1 HIGH · 6 MED2 days
api-b.example0 HIGH · 3 MED6 days
shop-c.example0 open1 day
panel-d.example1 HIGH · 2 MED4 days

4 companies · 13 findings · top risk HIGH

Sample data. The real report is co-branded, signed, dated.

How it runs

01

You name the portfolio. We set one group rate, in writing.

02

Companies ship. We retest after every release and sign every cycle report.

03

LPs and diligence get the co-branded posture, current and dated.

Why now

A funded startup needs security to close enterprise deals, pass a SOC 2, and survive diligence. A fund that provides it attracts stronger companies and closes diligence faster, without each founder hunting for a pentester on their own.

NIS2ISO 27001SOC 2signed report

Questions funds ask first

How is the portfolio priced?+

Below the list price (from €9,900/year per company), as one flat group rate for the batch. The number comes in writing before you commit, and there is no per-scan meter.

How many companies can the program cover?+

There is no fixed cap. The group rate scales with the number of companies and their external surface, always as a flat increment, always in writing.

What must a portfolio company provide?+

The domains of its external web and API surface, and a signed authorization with written rules of engagement. No internal network, no source code, nothing beyond the written scope.

What happens when a company has a finding?+

A researcher verifies it with a working proof of concept, rates it, and writes the remediation. The company gets its report; the fund sees it in the portfolio posture.

What do you hand over for LPs and diligence?+

The co-branded posture report per cycle: every company, findings by severity, top risks, last retest, signed and dated. You forward it; we do the rest.

portfolio program

Put the whole portfolio on one report.

20 minutes, a written group rate, and a plan per company.