We find the gaps before attackers do.
AngelForce is a cyber security company in Tallinn, Estonia. We test, monitor and defend the systems of organisations across Europe and Türkiye.
Scan your domain’s email security
Free. Checks SPF, DKIM, DMARC, DNSSEC, CAA and MTA-STS from your browser.
Certified team
- CEHCertified Ethical Hacker
- LPT MasterLicensed Penetration Tester
- CISACertified Information Systems Auditor
Organisations we have worked with
What we do
Five areas of work, all of them security. Choose one to see what it covers, how we work and what you receive.
-
Penetration testing
We attack your networks, applications and people the way a real adversary would, then show you how to close each gap.
- External and internal network tests
- Web and mobile application tests
- Social engineering
- Continuous security testing
-
Managed security
Our security operations centre watches your environment around the clock and acts on threats before they become incidents.
- SOC as a service, 24/7 monitoring
- Managed firewall
- Threat hunting
- Threat intelligence
-
Incident response
When something goes wrong, we contain it, find the root cause and help you recover.
- Emergency incident response
- Breach management
-
Consulting and training
We assess where you stand, set priorities with you and train your staff to recognise attacks.
- Security assessment
- Cyber security consulting
- Awareness training
-
Secure software
We build security into software from the first commit, and we build security tools of our own.
- Secure code review
- DevSecOps consulting
- Custom security software
- SecAudit for WordPress
-
Tell us what you need to protect
Describe your environment and what you want to achieve. We will reply by email.
Contact us
Free security tools
Eleven tools we use ourselves, free for everyone. Most run entirely in your browser, so what you enter stays with you.
-
SecAudit seal verifier
Check that a SecAudit security seal on a WordPress site is genuine, current and confirmed by its owner.
Runs in your browser, asks a public service -
Email security check
Grade a domain’s protection against spoofed email: SPF, DKIM, DMARC, DNSSEC, CAA and MTA-STS.
Runs in your browser, asks a public service -
Security headers scanner
Grade a website’s HTTP security headers, cookies and TLS certificate, with a fix for every finding.
Our server fetches the page -
Phishing link analyser
Paste a suspicious link or message and see where each link really leads, without opening it.
Runs in your browser -
Password breach check
Find out whether a password appears in known data breaches without revealing it.
Runs in your browser, asks a public service -
SPF and DMARC generator
Build correct SPF and DMARC records for your domain and check an existing SPF record.
Runs in your browser -
Email header analyser
Check SPF, DKIM and DMARC results, spoofed senders and the delivery path of an email.
Runs in your browser
What happens in a penetration test
The same five steps, whether we test one web application or an entire organisation.
Scope
We agree on targets, rules and timing in writing. Nothing is tested without your approval.
Reconnaissance
We map what an attacker can see: domains, exposed services, technologies and people.
Exploitation
We try to get in with the techniques real attackers use, and stop at the limits we agreed.
Reporting
Every finding comes with its risk, the evidence and a concrete fix, plus a summary for management.
Retest
After you have fixed the issues, we test again and confirm that they are closed.
SecAudit: security audits for WordPress
Our own product. SecAudit scans WordPress sites for malware, vulnerable code, changed files and known vulnerabilities, and turns the results into reports mapped to OWASP, GDPR and NIS2.
Launching soon.
From the blog
Practical security writing for people who run systems: what to fix, in what order, and why.
-
A practical WordPress security checklist
Twelve WordPress hardening steps in a sensible order, from updates and abandoned plugins to 2FA, XML-RPC, backups, file integrity and a WAF.
-
Run a two-hour incident response tabletop this week
Run a two-hour ransomware or account-takeover tabletop with a small team, log the gaps, and turn them into a short runbook with named owners.
-
Security headers that matter, and the ones to retire
A practical guide to CSP with nonces, HSTS and preload, frame-ancestors, Referrer-Policy, Permissions-Policy and COOP, with examples and what to drop.
Who does the work
Our consultants hold internationally recognised security certifications.
- CEHCertified Ethical HackerEC-Council
- LPT MasterLicensed Penetration TesterEC-Council
- CISACertified Information Systems AuditorISACA
Check our own security
A security company should be able to show that its own house is in order. This site has no database, no login and no cookies, and it sends strict security headers. Verify it with the same public tools your auditors use.
- Security headers securityheaders.com
- TLS configuration Qualys SSL Labs
- Web security Mozilla Observatory
- Web and email standards Internet.nl
Tell us what you need to protect
Describe your environment and what you want to achieve. We will reply by email.
Contact usAngelForce OÜ · Tallinn, Estonia