Cyber security
Find the holes in your website before attackers do.
We assess your website's weak spots with frontier AI models such as Claude Fable 5.1 and an engineer's review, then hand you a clear, ranked report so your team can fix them — before someone else finds them.
Only with your written permission. Never destructive — we look, we do not break in.
Sample report
5 findings- CriticalAdmin login reachable with no lockout or second factor
- HighContact form passes input straight into the page (XSS)
- HighPlugin 3 versions behind, with a published weakness
- MediumNo DMARC record: mail can be sent in your name
- LowFive browser security headers not set
Illustrative — the shape of what you receive, not results from a real site. Each finding comes with its evidence and the fix.
The size of the problem
Attacks are not rare, and they are not cheap.
29.44 lakh
cyber security incidents handled by CERT-In in 2025 — up from 15.92 lakh in 2023
Source: Government of India, Lok Sabha reply / PIB, 2026
₹25.5 crore
average cost of a data breach to an organisation in India — an all-time high, up 15.9% in a year
Source: IBM Cost of a Data Breach Report 2026
₹22,845 crore
lost by Indians to cyber fraud in 2024, about three times the year before
Source: Ministry of Home Affairs, Lok Sabha reply, 2025
31%
of breaches worldwide began with an attacker exploiting a known weakness
Source: Verizon Data Breach Investigations Report 2026
88%
of breaches at small and medium businesses involved ransomware
Source: Verizon Data Breach Investigations Report 2025
263 days
on average for an Indian organisation to find and contain a breach
Source: IBM Cost of a Data Breach Report 2025
What we look for
The ten weak spots behind most website attacks.
None of these needs a genius attacker. Most are found by automated scanners that visit every website on the internet, every day.
Outdated software and plugins
An old WordPress plugin, CMS or library with a published weakness is the easiest door there is — attackers scan for them automatically.
Exposed admin panels
Login pages anyone can find, default passwords, no lockout after repeated guesses, no second factor.
Injection and cross-site scripting
Forms and URLs that pass what a visitor types straight into a database query or back onto the page.
Broken access control
Pages, files or order records another customer can open just by changing a number in the address.
Weak HTTPS and missing headers
Expired or misconfigured certificates, and the browser protections a site never switched on.
Email spoofing
No SPF, DKIM or DMARC on your domain, so anyone can send mail that looks like it came from you.
Leaked keys and secrets
API keys, payment credentials and database passwords left inside the website's own code or files.
Open cloud storage
Uploads, invoices and backups in buckets that anyone with the link — or a scanner — can list.
Risky third-party scripts
Chat widgets, trackers and plugins loaded from other servers, each one able to change your page.
Unprotected forms
Contact and OTP forms with no rate limit, open to spam floods, fake sign-ups and SMS-bill attacks.
How it works
From your first message to a closed finding.
- Step 1
You get in touch
Tell us the website and what worries you — through the form below, a call, or contact@questico.site.
- Step 2
Written permission
We only test a site you own or are authorised to have tested, and only after you confirm that in writing. No permission, no test.
- Step 3
AI-assisted assessment
Frontier AI models such as Claude Fable 5.1 work through your site alongside an engineer. Non-destructive: we look for weaknesses, we do not break in or take data.
- Step 4
Your report
Every finding ranked by severity, with the evidence and plain-language steps your developer can follow to fix it at your end.
- Step 5
A second look
Once your team has applied the fixes, we check the same findings again so you know they are closed.
Did you know
Six facts worth knowing before your next launch.
For the first time in the report's 19 years, exploiting a known software weakness overtook stolen passwords as the most common way into a breach.
Phishing by SMS and voice call succeeds about 40% more often than phishing by email.
About a quarter (26%) of malicious breaches in India in 2026 were AI-generated.
Indian organisations using AI and automation extensively in security paid ₹10.3 crore less per breach than those using none.
Under India's Digital Personal Data Protection Act, failing to take reasonable security safeguards can draw a penalty of up to ₹250 crore.
Organisations in India must report specified cyber incidents to CERT-In within 6 hours of noticing them.
Make your website harder to break
Tell us your website. We will tell you where it is weak.
Write to us, send the form, or book a call — whichever is easiest. We reply within one business day.