Find the backdoors before someone else does.
Boutique DevSecOps for Linux infrastructure. We find the exposure - reverse shells, open ports, rootkits, dangerous defaults - and we close it. Read-only assessment first. Hands-on hardening second. No blind deployments.
Engagements start on Mondays · current lead time about a week ·US Delaware LLC · Stripe & Payoneer · NDA on request
Stacks we assess & harden
You didn't build this to be secure. You built it to ship.
Infrastructure that grew fast grows holes. None of these are edge cases - they're the default state of a server nobody hardened. Every one is a door.
Root SSH login is still permitted - and you're not sure who holds a key.
A container is running as root, mounting the host filesystem.
Ports are open to 0.0.0.0 that you don't remember opening.
sudo NOPASSWD is set somewhere, and it wasn't you.
The last security patch was "we'll get to it."
You inherited the server. You have no idea what's actually running on it.
The firewall status is "disabled," and has been for months.
If something were mining crypto or phoning home right now, you'd have no way to know.
You don't need a full-time DevSecOps hire at $180k/yr to answer these. You need a senior engineer to look, tell you the truth, and fix it. That's the entire business.
Don't take our word for it. Scan your own server.
owlzops-mapper is the exact agentless EDR-lite binary we run on day one of every engagement. One static Rust binary, zero dependencies, read-only. It never modifies your system and never phones home. Run it now - you'll see the same red flags we would.
$ sudo owlzops-mapper audit
🦉 Owlzops Mapper v0.5.16
🔍 Scan completed in 2.50s
🔒 Risk Score: 60/100 (At Risk)
Security −60 Reliability −0 Hygiene −0
🛡 Security Findings
╭──────────────────┬─────────┬──────────────────────────────────────────────────────╮ │ CIS / Ref ┆ Penalty ┆ Finding │ ╞══════════════════╪═════════╪══════════════════════════════════════════════════════╡ │ CIS 5.2.10 ┆ -25 ┆ SSH root login allowed │ │ CIS 5.4.2 ┆ -15 ┆ Sudo NOPASSWD entries found │ │ CIS 5.3 ┆ -15 ┆ Passwordless sudo to ALL commands │ │ CIS 5.2.4 ┆ -10 ┆ SSH password authentication enabled │ │ - ┆ -8 ┆ Non-root processes hold critical kernel caps │ │ CIS 5.2.10/5.2.4 ┆ -5 ┆ Root login with password allowed │ │ CIS 5.2.3 ┆ -5 ┆ Docker containers without memory limits │ │ CIS 5.2.2 ┆ -3 ┆ Docker containers without CPU limits │ ╰──────────────────┴─────────┴──────────────────────────────────────────────────────╯
Hostname ······· prod-api-03 · Ubuntu 24.04 · Docker, Nginx, Apache, PHP
exit code 1 - critical findings ▌
You're about to give someone root. Check them first.
Most consultancies ask you to trust a logo wall. Our work is on GitHub - read it before you write to us.
the tool is source-available
The scanner we run on day one - owlzops-mapper - is published under Apache 2.0 with the Commons Clause: free for your company to use forever, but not to resell. Every check and every severity rule is public. Read it, run it, keep it - with or without us.
supply chain, verifiable
Releases are GPG-signed with published SHA256 checksums. CI pins every GitHub Action by commit SHA, runs cargo audit and cargo deny, and ships an SBOM with each release. We hold our own tooling to the standard we'll hold yours to.
read the engineering
Memory forensics via process_vm_readv instead of ptrace. Detection logic mapped to CIS Benchmarks. A public changelog documenting every false positive we found and killed. Judge the depth yourself.
Case study · our own infrastructure
I ran it on our own server first. It scored 60.
Serhii Drobot, founder
60
At Risk
23
Healthy
Risk Score, owlzops-mapper
One production host · Ubuntu 24.04 · Apache, Nginx, PHP, MariaDB, Docker
Before I ask you to run this against your production, here's what it found on mine. Not a lab box - the machine that actually serves this company.
60 out of 100. At Risk. Root SSH login permitted. Password authentication on. A user with passwordless sudo to every command on the box. FTP listening on 0.0.0.0. Containers with no memory or CPU limits. None of it exotic - that's what a server looks like when a control panel sets it up and nobody goes back.
What I closed
| CIS | Finding | Was |
|---|---|---|
| 5.2.10 | SSH root login allowed | −25 |
| 5.3 | Passwordless sudo to ALL commands | −15 |
| 5.4.2 | Sudo NOPASSWD entries (2 → 1) | −15 |
| 5.2.4 | SSH password authentication enabled | −10 |
| 5.2.10/5.2.4 | Root login with password allowed | −5 |
| 5.2.3 | Docker containers without memory limits | −5 |
| 5.2.2 | Docker containers without CPU limits | −3 |
| - | FTP (port 21) exposed to the internet - unscored, closed anyway | 0 |
What I didn't close - and why
Two findings survive. They'd survive on your box too, if you run the same stack.
hestiaweb ALL=NOPASSWD:/usr/local/hestia/bin/*
The panel's web user can run any script in that directory as root, without a password. If one of them takes a filename as an argument, that's a root shell - and the web user is the first thing an attacker owns. I can't remove it: the panel's own cron calls it every two minutes. Remove the line, the panel stops.
apache2 (uid 33) holds CAP_DAC_OVERRIDE
It reads vhost configs and certificates out of each user's home directory at startup. Drop the capability and Apache doesn't start. Same for NoNewPrivileges: the master process must setuid into each site's user, so enabling it kills the server outright. I tried. It did.
When you can't remove a risk, you watch it
That's what a compensating control is. auditd now runs with a ruleset written for exactly those two findings - not the vendor default, which is noise pretending to be security:
-w /usr/local/hestia/bin -p x -k hestia_sudo -w /etc/sudoers.d -p wa -k sudoers_change -a always,exit -F arch=b64 -S execve -F euid=0 -F auid>=1000 -F auid!=-1 -k root_exec
Every execution out of that directory is logged. Every change to sudoers is logged. Every time an ordinary user becomes root, it's logged. That isn't as good as removing the path. It's what's available without breaking the machine - and it's the difference between finding out in the logs and finding out from your customers.
One more. I stripped CAP_SYS_ADMIN and CAP_SYS_PTRACE from Apache and atd - a web server running as uid 33 could read the memory of every other process on the box. The Risk Score didn't move: 23 before, 23 after. The rule is binary, and other processes still hold capabilities they legitimately need. I did it anyway. We harden infrastructure, not the number on the dashboard.
It finished at 23, not 0. Anyone promising you zero on a real production machine is either lying or about to break it. The job isn't a perfect score - it's knowing exactly what's left, why it's there, and what's watching it.
The scanner tells you something's wrong. We tell you how wrong - then we fix it.
Fixed price. Defined scope. No hourly billing, no open-ended retainer trap. The engineer who scopes your work is the one who does it.
| Service | What you get | Scope | Price |
|---|---|---|---|
|
Infrastructure Security Audit
Start here |
Read-only IoC sweep, attack-surface map, risk matrix with CIS references, 60-min findings call, written remediation plan. Diagnostic only - no changes made. | 3 business days up to 10 hosts |
$2,995
$2,695 w/ scanner report |
|
Hardening · Essentials
The fix - small stack |
SSH lockdown, default-deny firewall, rootless containers, patch & sysctl baseline. Staged and reversible, with before/after proof and full handover. | 5 business days up to 3 hosts |
$5,900
$2,905 after audit credit |
|
Hardening · Standard
The fix - full fleet |
Everything in Essentials, plus network segmentation, private database networking, bastion where justified, and Kubernetes RBAC, network policies & pod security. | 10 business days up to 10 hosts |
$11,500
$8,505 after audit credit |
|
Continuous Hardening
Stay hardened |
Weekly drift scans against your hardened baseline, monthly posture report, and 3 or 10 engineering hours per month. Two tiers - see below. | monthly 30 days' notice to cancel |
$2,500 or $5,000
per month |
Infrastructure Security Audit
"What is exposed to the internet - and is anyone already inside?"
$2,995
3 business days · up to 10 hosts
The single most expensive question you can't answer yourself. We take root/sudo access, sweep every host read-only, and hand you the truth in writing.
What's included
-
The same open-source binary you can run yourself - but driven by the engineer who wrote it, with --deep forensics enabled. Every operation is read-only: nothing on your system is modified, no agent is installed, no data leaves your servers. Our access is scoped, logged, and revoked the moment the engagement ends.
-
A full /proc sweep plus deep memory forensics: reverse shells and C2 connections, executables running from memory (memfd) or deleted from disk, known miners, library injection, hidden PIDs from LKM rootkits, bind-mount masking, and container runtime capability tampering. Suspicious cron jobs and systemd timers are classified by severity - that's where persistence hides.
-
Listening ports with their bind address (a database on 127.0.0.1 is a very different story from one on 0.0.0.0), firewall state, SSH configuration, sudo and sudoers entries, container mounts and capabilities, TLS certificate expiry. The output is what an attacker enumerates in their first five minutes - you just get to see it first.
-
Not a 400-page tool dump. Findings are ranked by what an attacker hits first, scored with environment awareness (a kubelet host isn't penalised for ip_forward=1), and split into Security, Reliability, and Hygiene so one noisy category can't mask a real problem. Every security finding cites its CIS rule - evidence you can hand straight to a SOC 2 or ISO 27001 auditor.
-
Live, with your engineers in the room. We show the actual evidence for each critical finding, answer "how bad is this really," and agree the remediation order together. No slide deck, no account manager - the engineer who did the work.
-
Yours to keep, forever, whether or not you hire us to fix anything. Written so a founder can read it and an engineer can act on it. Raw JSON/Excel exports included if you want to feed them into a SIEM or diff them later.
Not included: implementation. This gives you the truth and the plan. Fixing is the Hardening engagement - and the $2,995 audit fee comes off that price in full.
Run the scanner first. If it comes back clean, we'll tell you so - and we won't sell you the audit. We'd rather lose the sale than take $2,995 for confirming what a free tool already told you.
why $2,995
3 days of senior DevSecOps engineering at $1,000/day. A full-time hire costs $19,000+/month loaded and takes three months to find; this answers the question next week, with no headcount. Bring your own mapper report and it's $2,695.
Infrastructure Hardening
"We close the gaps the assessment found - without breaking production."
$5,900 or $11,500
5 or 10 business days
less your $2,995 audit fee
Fixed price, fixed scope. Everything below is included in every Hardening engagement - your audit findings determine the order we do it in, not whether it's covered. Every change is staged, reversible, and proven. Two tiers, priced by fleet size, not by discount:
$5,900
Essentials · up to 3 hosts · 5 days
SSH lockdown, default-deny firewall, container hardening, patch & sysctl baseline, before/after proof, handover.
For a single VPS or a small production stack. $2,905 after audit credit.
$11,500
Standard · up to 10 hosts · 10 days
Everything in Essentials, plus network segmentation, private database networking, bastion where justified, and Kubernetes hardening.
For a real fleet with services to separate. $8,505 after audit credit.
What's included
-
Password auth off, root login off, every authorized key audited and the orphans revoked. Sudoers cleaned up: no more blanket NOPASSWD: ALL. Where the topology justifies it, a bastion so your production hosts aren't reachable from the open internet at all. We always keep a tested path back in - nobody gets locked out of their own servers.
-
A default-deny firewall (nftables/ufw) with an explicit, documented allow-list - not 40 rules nobody remembers adding. Databases move off 0.0.0.0 onto private networks. Network segmentation so a compromised web container can't reach your database directly. Rules land staged, with connectivity verified at each step.
-
The single highest-leverage fix on most stacks. No more privileged containers, no more /var/run/docker.sock mounted into an app (that's a one-line container escape to host root). Non-root users, dropped Linux capabilities, read-only filesystems, resource limits so one container can't OOM the box. Already on Kubernetes? Same pass covers RBAC, network policies, pod security standards, and secrets handling.
-
Pending security updates applied on a controlled schedule (with unattended-upgrades configured so it doesn't rot again), kernel sysctl hardening tuned to your actual workload, fail2ban against brute-force, and auditd so there's a forensic trail if it ever happens again. Aligned to CIS Benchmarks - the same references your auditor will ask for.
-
Hardening that takes down production is a worse outcome than the vulnerability. Every change is tested in staging first, applied in small reversible steps with a rollback path defined before we start, and scheduled with you. "Secure by default. No blind deployments" isn't a slogan - it's the delivery method.
-
Most security work is invisible - you pay, and nothing looks different. So we prove it: a colour-coded owlzops-mapper compare diff of your infrastructure before and after, with the Risk Score movement and every closed finding itemised. Evidence for your board, your customers, and your auditor.
-
Infrastructure only one person understands is itself a vulnerability - that's true of us too. You get the runbooks, the diagram of what your stack now looks like, and a recorded walkthrough of every change and why it was made. Then we revoke our access. If you never call us again, everything still works and your team knows why.
why $5,900 / $11,500
Senior DevSecOps engineering at ~$1,180/day against a fixed scope, with a rollback path defined before we touch anything. We price by fleet size, not by discount - a smaller stack needs fewer days, so it costs less. The rate never moves. A full-time hire costs $19,000+/month loaded and takes three months to find.
More than 10 hosts? We quote a fixed price at the same day rate once the audit tells us what's actually there. No hourly billing, ever.
Scope a Hardening Engagement →Continuous Hardening
"Config drifts. New ports open. People add keys."
$2,500 or $5,000/mo
30 days' notice to cancel
Hardening is a state, not an event. Both tiers include weekly owlzops-mapper drift scans diffed against your hardened baseline, so a new open port or an added SSH key surfaces in days - not after the incident.
$2,500/mo
Starter · up to 10 hosts
- ✓Weekly drift scans, diffed against your hardened baseline
- ✓Monthly security posture report: new exposures, expiring certs, pending patches
- ✓3 engineering hours/month for patching and small fixes
- ✓Priority email support, answered within 2 business days
Monitoring, plus enough hours to close small gaps before they compound.
$5,000/mo
Standard · up to 10 hosts
- ✓Everything in Starter
- ✓10 engineering hours/month for patching and small fixes
- ✓One hardening verification pass per quarter, with a before/after diff
- ✓Incident acknowledged within 4 business hours
For teams running production without a dedicated security engineer.
Available after an Audit or Hardening engagement - we only monitor baselines we've verified ourselves. Unused hours don't roll over. More than 10 hosts: fixed quote at the same rate. Not a replacement for a full internal security team or a 24/7 SOC.
why $2,500 / $5,000 per month
Standard is 10 hours of senior engineering at $500/hour, plus continuous drift detection and an engineer who already knows your stack. A full-time DevSecOps hire is $19,000+/month loaded - Standard is a quarter of that, with no recruiting and no notice period.
When we're not the right call
Saying this up front saves us both a discovery call.
- You're actively on fire right now - a live, confirmed breach in progress needs a retained IR firm with legal and forensic chain-of-custody, not a boutique assessment
- You need a full-time embedded engineer or a 24/7 SOC replacement
- You want a compliance checkbox and a PDF, but no intention of changing the infrastructure
- Your stack is entirely managed serverless with no hosts to harden - there's less here for us to fix
- You want penetration testing of your application code - that's a different specialty, and we'll refer you
How an engagement works
Scan. Assess. Harden. Verify. No step happens blind.
01 · scan
You see it first
You (or we) run owlzops-mapper. Read-only, under a second, no agent left behind. The red flags are immediate - and you don't have to trust us to get them.
02 · assess
We map how deep it goes
Indicators of compromise, attack surface, risk ranked by exploitability with CIS references. You get the truth and a prioritized plan in writing.
03 · harden
We close the gaps
Staged, reversible steps. Rootless containers, locked-down SSH, default-deny firewalls, segmented networks. Tested in staging, scheduled with you. Never blind.
04 · verify & hand over
We prove it, then leave
A before/after scanner diff proves every risk we dropped. You get runbooks, diagrams, and a recorded walkthrough. Then we revoke our access.
Secure by default. No blind deployments.
Five rules that shape every engagement, not just marketing copy.
"We'd know if we'd been hacked"
Assume breach. Every engagement starts as if you're already compromised. The cheapest time to find out is before the incident, not during it.
"Just give us root and trust us"
Read-only first. Nothing we run during assessment can change your system. You see everything we see - with our source code open - before you trust us with a single fix.
Consultant keys that live in your authorized_keys forever
Least privilege, then leave. We take the minimum access needed and revoke it the moment the engagement ends. No standing keys. We refuse to become the vulnerability we were hired to remove.
Scoping you into the bigger engagement because it pays better
Simplicity is security. Fewer moving parts, fewer holes. If Essentials closes your three hosts, we won't scope you into Standard. If a firewall rule fixes it, you don't need another tool to maintain. The smaller, boring fix is usually the safer one - and we'll say so even when the bigger one pays us more.
Infrastructure only the consultant understands
No tribal knowledge. Infrastructure only one person understands is itself a vulnerability. Every engagement ends with runbooks, diagrams, and a recorded walkthrough your whole team owns - whether or not you ever call us again.
Who you're actually hiring
Owlzops is a boutique DevSecOps practice specialising in Linux infrastructure, containers, and security hardening. The person who scopes your work is the person who does it. Senior engineers only - no juniors inheriting your production, no handoffs, no account manager standing between you and the engineer with root.
Boutique is a deliberate choice, not a limitation. We take a limited number of engagements at a time, because security work done at volume turns into security theatre. You get a direct line to the engineer holding your credentials - and an honest answer when your problem isn't ours to solve.
It also means we build our own tools. owlzops-mapper - the agentless scanner we run on day one - is on GitHub under Apache 2.0 with the Commons Clause - free for your company to use forever, with or without us. Not open source in the strict sense: the Commons Clause stops third parties reselling it as their own product. Everything else is yours. You can read every line of what we run on your servers before we run it. That's not marketing; that's the only honest way to ask for root.
Serhii Drobot
Founder · Owlzops
I've spent my career in Linux infrastructure - Kubernetes across GKE, EKS, AKS and OpenShift, Terraform and Ansible, Docker in production. I started Owlzops because I kept finding the same things on other people's servers: root SSH still open, a container running privileged with the Docker socket mounted, a firewall nobody had ever switched on. Not exotic attacks. Defaults nobody turned off.
I wrote owlzops-mapper because I was tired of doing that audit by hand, and I published the source because you shouldn't have to take a stranger's word about what runs on your box. Read the code before you run it. Then decide whether you want me anywhere near your production.
Legal & billing
- Owlzops LLC - registered in Delaware, USA
- Payments via Stripe - PCI-DSS Level 1; we never see card data
- Corporate settlement via Payoneer
- International contracts accepted · invoicing in USD
- Mutual NDA available before any discovery call
Access hygiene
- Every credential we're granted is scoped, logged, and revoked on completion
- Audit work is read-only - nothing is modified
- No data leaves your servers during scanning
- Reports accepted PGP-encrypted or redacted
- Changes are staged, reversible, and scheduled with you
Find out if you're exposed. This week.
Book a short call, or just run the scanner first. We'll tell you exactly where your risks are - no pitch, no fluff, no obligation.
Engagements start on Mondays · current lead time about a week · we take a limited number at a time
[email protected] · we reply within one business day