# Cybersecurity research

We study your website and infrastructure the way an attacker would: vulnerability scanning, dependency and plugin audits, configuration and hosting review, and penetration testing — then we fix what we find and harden the rest. You get a prioritized, plain-language report, not a scare deck.

- Vulnerability scanning and audits
- Dependency, plugin and module review
- Configuration and hosting hardening
- Penetration testing
- Incident response and forensics
- Prioritized, plain-language report

## The threat is not theoretical

*Public figures from security research — the point of the work below is to keep you out of them.*

- **≈ 40,000** — new vulnerabilities were published in 2024 — every dependency you run is somewhere in that pile *(CVE.org)*
- **68%** — of breaches involve a human element — credentials, phishing, misuse *(Verizon DBIR 2024)*
- **258 days** — is the average time to identify and contain a breach — for those who get there without help *(IBM Cost of a Data Breach 2024)*
- **$4.88 M** — is the average cost of a data breach worldwide *(IBM Cost of a Data Breach 2024)*
- **51%** — of web traffic is automated — bots probing, scraping, credential-stuffing your forms *(Imperva Bad Bot Report 2024)*

## Research

We watch the threat landscape so you don’t have to: CVE feeds for every component you run, exploit research, and the OWASP Top 10 applied to your actual code — not to a template checklist. When a new vulnerability matters to you, you hear it from us before you read it anywhere else.

## Audits

A full-stack audit of your site and infrastructure:

- Dependency, plugin and module inventory — everything with a version
- Configuration and hosting review: PHP, headers, permissions, TLS
- Authentication and access control testing
- OWASP Top 10 application testing (injection, XSS, CSRF…)
- A prioritized, plain-language report: what matters and what it costs to fix

## Protection

What we run once the audit findings are closed:

- Hardening: patched stacks, least privilege, WAF rules
- Monitoring and anomaly detection, with alerting
- Incident response: containment, forensics, recovery
- An ongoing CVE watch over everything you run

---

Tum de dum — Technological production agency · Barcelona

- [Services](https://tumdedum.com/en/services.md)
- [Contact us](https://tumdedum.com/en/contact.md)
- [HTML](https://tumdedum.com/en/services/cybersecurity-research)