Further Security Services
As well as application testing, I offer other security related services too. Security has to be implemented system-wide, and I can cover those parts of your system that, for whatever reason, you can't cover yourself.
System Monitoring and Response
There's little point in having a burglar alarm on your house if no one is going to either hear it or respond to it when it goes off. The same is true of most computer based security systems. If no one is looking at your server logs, an attacker can spend days probing the system trying to find a way in.
If your logs aren't monitored, I can do it for you. I don't take the responsibility of blocking IP addresses or closing accounts being used to attack a system, but I can spot when something is happening and tell you so you can make a decision.
Log monitoring normally takes up a few minutes of each a day, invoiced as a couple as hours per week. Some systems require more or less than this, depending on threat level and complexity.
Patch Notifications
One of the most frequent ways attackers break into systems is by finding out who is using out-of-date applications and code libraries, and exploiting them. It's trivial - run a Google search for the tell tale signs of out-of-date code, then use a ready made exploit from a service like Exploit-DB or MetaExploit to break in. There's only one solution to this: monitor for updates to the code you use and apply those updates as soon as they appear.
In practice this sort of monitoring often doesn't get done because employees are too busy to do it. I subscribe to lots of mailing lists and am on the alert notifications for all sorts of applications and code libraries. Although I don't do the actual patching (I don't, as a rule, tamper with client's systems), if something comes up that you need to know about I can tell you about it. Insistently. I will nag, repeatedly, until someone applies the patch.
