Audit, pentest and threat monitoring: three different jobs
An audit describes state, a pentest checks a scenario, monitoring stays on. Those are three contracts, not three names for one service.
People buy them as one sentence: "check security". Then they expect a one-off report to catch a night defacement, or a watching subscription to replace a check of whether the account portal can be entered. The estimate grows and the hole stays. We split this into three jobs so each one ends with its own result.
What each one ends with
- A website security audit: a list of the site's current state. The basic audit is free for new clients and usually takes a few days. It does not check whether a weakness can be used.
- A pentest: confirmed scenarios under written permission, a report and a retest. Guide price from $50 per endpoint, usually 1-3 weeks.
- Threat monitoring: a subscription. An email or a message when availability or the look of an agreed page changes.
A calm order for a new site is simple. An audit first, so you do not stand guard over an admin panel that is already open. Then a pentest if there are roles, payments or an account portal. Monitoring goes on when there is something to guard and someone to call. The subscription does not issue a compliance certificate. If the watch has already fired, the next read is what to do with a night alert.
Related Lexora services
You can pick one job, not all three
We can say what your site needs now: a snapshot, a scenario test or a night watch.