Within just two to three months, they resolved issues that previously seemed unresolvable.
Tim Johnson
CTO
Magento security audit
Every control treated as unproven until evidence says otherwise. Each item resolved to Pass or Fail against captured output, not opinion.
Adobe Commerce gold partner
#1 Adobe Commerce partner worldwide
Hyvä Platinum Partner
40+ projects delivered
ISO certification
9001 & 27001
Most certified Hyvä agency worldwide
200+ Adobe Commerce Certifications
Magento Association
Platinum Partner
Trusted by brands globally
A config review won't tell you if you're breached
Ransomware announces itself. A payment skimmer sits quietly in your checkout, taking card details for months while every metric looks normal.
On a platform taking cards, that's the difference between a vulnerability and a data-loss event
Patching closes the door
It doesn't remove whoever is already inside. These four survive an upgrade untouched.
- Webshells
- Injected skimmers
- Rogue admin accounts
- Stolen API tokens
The validation mandate
Most audits look for known issues. Ours assumes insecurity until evidence says otherwise.
No assumptions
Controls claimed present are re-verified live. Where documentation and platform disagree, the platform wins.
No trust
Access paths traced to effective permission, not intended. Role names resolved to what the holder can do.
No ambiguity
Pass or Fail, supported by command output, a configuration export or an HTTP response.
Read-only, always
Configuration reads, permission queries, static analysis. No changes, no exploitation attempted.
Written to be forwarded
Shareable with a bank, partner or enterprise reviewer without editing.
Every verdict arrives with its evidence attachedCommand output, a configuration export or an HTTP response, so any finding can be re-checked by someone who wasn't there.
What a report looks like
Redacted from a real report. Verdicts are written so a non-technical reader can act.
2. Executive summary
29findings
7Passed
- 0Critical
- 6High
- 10Medium
- 8Low
- 5Info
Findings by severity
| Area | Verdict | Finding |
|---|---|---|
| External perimeter | Holds | Edge-only ingress enforced at the network layer. Origin unreachable directly. |
| Administrative exposure | Inconsistent | Internal consoles address-gated; storefront admin reachable from anywhere. |
| Identity and access | At risk | Shared credential path, no per-person revocation, no attribution. |
| Detection and response | Largely absent | Rate limiting off, image scanning off, audit logging disabled. |
| Secret management | Sound | No credentials in the repository or in git history. |
| Workload hardening | Minimal | No segmentation, no admission policy, no container security context. |
What we check
Three layers, examined against your version, configuration and hosting.
The application and its configuration
Plus roles, file permissions, mail authentication and backups.
- Platform currency and patch backlog
- Admin hardening and lockout policy
- Two-factor and reCAPTCHA coverage
- Session and transport settings
- Content Security Policy, all page types
- Carding and abuse resistance
The infrastructure underneath
Plus DNS hygiene, secret storage and recovery testing.
- Edge WAF, rate limiting and bot rules
- Origin exposure, enforced at the network
- Server and service support status
- Identity paths and effective permission
- Detection coverage and where alerts go
- Encryption in transit and at rest
Whether you're already compromised
Plus session integrity and access-log review.
- Malware and webshell scanning
- PHP outside deployment paths
- Checkout templates and JavaScript
- Admin inventory and login anomalies
- Integration tokens and API keys
- Cron, tasks and database triggers
AI reads everything. People decide what it means
A Magento estate is too large to examine by hand in the time anyone will pay for, so traditional audits sample. Sampling is how findings get missed.
What AI does
Reads every custom module, not a sample
Including the modules nobody documented and the one a contractor wrote in 2019.
Compares your core against the official release
Every modification surfaced, then classified as customization, forgotten patch or something else.
Flags what doesn't look like your codebase
Obfuscated, encoded or split-across-files skimmers, caught by anomaly detection at file level.
Maps versions to advisories at scale
Magento, extensions and every composer dependency against published CVEs, in minutes.
Reads a month of access logs
Millions of lines searched for exploitation attempts, public-path writes and login anomalies.
Sweeps configuration against the checklist
Every item read from live values rather than from documentation.
What only a person does
Decides whether a vulnerability is reachable
A CVE matching your version means nothing until someone establishes it's exploitable here.
Separates a customization from a compromise
A skimmer that looks like analytics, or an integration reported as a breach. Both calls are human.
Applies your business context
Whether an account should exist, or an endpoint is deliberate. AI can't know, and guessing is worse.
Confirms a compromise before you're told
Nobody hears they've been breached on the strength of a machine flag. Evidence is verified first.
Signs the report
Every finding carries a certified engineer's judgment. AI drafts, people are accountable.
1
Tooling and scanners
Collection
Codebase, config, logs, dependencies and infrastructure state captured
Deterministic scanning
Static analysis, dependency and CVE matching, integrity comparison
2
AI
AI analysis
Every file read, patterns classified, candidates ranked by reachability
3
Certified engineer
Human verification
Exploitability on your configuration, severity, business context
Evidence gate
No finding enters the report without a captured artefact behind it
Evidence is verified by an engineer first. Then you hear it the same day, before the document exists.
400 signals
become around a dozen findings worth your attention. The reduction is the work.
Can an AI invent a finding?
Not into the report. Every finding must cite a captured artefact that anyone can re-check afterwards. A claim without an artefact never reaches you.
Does our code go into a public model?
No. Client code and configuration are handled inside our ISO 27001 practice, under the same read-only, least-privilege, revoked-at-the-end rules as the rest of the audit.
Your code and data stay inside our ISO 27001 practice and are never used to train a model.
How severity is decided
Not by a scanner's score. By reachability and blast radius on your configuration.
- 1CriticalAdmin capability or data exposure reachable anonymously, from the public internet.
- 2HighSubstantial privilege or loss of accountability, reachable by a narrower set of actors.
- 3MediumA defence-in-depth gap that materially worsens another compromise.
- 4LowA hardening gap with limited practical exposure.
- 5InfoA best-practice observation with no demonstrated exposure.
Severity is argued, not asserted
Where a finding is rated lower than it looks, the report says why, so you can disagree with the reasoning.
What you receive
One document, written for the reader who won't open the detail and the one who will.
The section most audits leave out
What we could not verify, and why
Executive summary
Where the estate is sound, where the material risk sits, and what would move it.
Findings by phase
Risk in commercial terms, audit goal, what was checked, and a validation table.
Prioritised remediation roadmap
Sequenced work grouped by urgency and dependency, outage-risk items flagged.
Re-validation criteria
What done looks like for each item, so completion is testable, not declared.
Ownership and touchpoints
Who does each piece, and what we need from you, listed up front.
What was not validated
Recorded explicitly, so no area is presented as clean by omission.
Method, access and evidence
What was used, how it was tested, and where the artefacts are retained.
Outdated is not the same as exploitable
Automated tooling is part of the audit, not the point of it.
A scanner reports61 dependencies out of date
The audit reports9 of those 61 are reachable from the storefront, the rest are dev dependencies
A scanner reports4 CVEs match your version
The audit reports1 CVE is exploitable on your configuration, and is being used in the wild
A scanner reportsA missing security header
The audit reportsThat header matters here because checkout loads three third-party scripts
A scanner reports400 findings sorted by CVSS
The audit reports11 findings that need action, in the order they should be done
What we need, and why
Security work needs the access attackers want. All of it read-only.
Least privilege, no changes- ISO 27001 certified
- Never published
0
Changes made to production. Every check is a configuration read, a permission query or static analysis.
SSH
Server configuration, file system and malware analysis
Database, read-only
Configuration review, admin and token inventory
Magento admin account
Configuration, extension inventory, cache and indexer status
Git repository
Code review, version control settings, history secret scan
Hosting and web server
Execution rules in writable paths, TLS, exposed services
Cloudflare or CDN dashboard
Edge WAF, rate limiting, TLS mode, headers, request logs
Access and error logs
Exploitation attempts, cron history, incident timeline
Payments and integrations list
Extension vulnerability and payment-flow review
Scope and what it costs
Larger estates, multi-environment setups and complex hosting are scoped on the first call.
A standard assessment is around 40 hours
The full pass across application, infrastructure and compromise assessment, plus the report and roadmap.
Quoted as a fixed price before work begins
Under our Fixed Cost Estimate Guarantee, so the approved number is the number you pay.
A lighter quarterly check exists too
Around 10 hours against our standard checklist, each item marked Done or Failed, failures estimated.
Remediation is quoted separately
Only once the findings show what's actually required, so nobody pays for a fix list written blind.
When to run one
You don't need to suspect a breach. You need a reason to want certainty.
Patches have been skipped and nobody can say which
A partner or bank is asking security questions- Fraud or chargebacks have moved
You've inherited a store, or you're buying one
Peak season is coming, when your team is busiest- Something looks wrong and you can't prove it
If you think you're compromised, don't book an audit
A skimmer steals card data every hour it runs. Our emergency line puts a certified developer on your store within an hour.
Then we fix it, and keep it fixed
Findings are only worth the remediation behind them, and the cadence that stops the drift coming back.
Remediation from real findings
Scoped after the report, with the approved estimate as the final price.
Patch management that doesn't lapse
Under a support plan, Adobe's releases are applied on schedule.
Quarterly checks
The lighter checklist on a cadence, so drift gets caught while it's cheap.
Monitoring that notices
File integrity, uptime and anomaly alerting, with 24/7 response behind it.
What partners say about us
I can definitely recommend them for complex digital commerce projects, their strategic approach helps us massively save on operational costs.
Kevin Hughes
European Technical Director
There is no challenge for which they can't find a solution.
Will Aubuchon
CEO
What I value most is consistency. Magebit knows our store inside out, responds fast, and keeps it running smoothly year after year.
Marian Gaidoš
CEO
Why ambitious brands choose Magebit
#1 Adobe Commerce partner worldwide
The top-ranked Adobe Commerce agency on the planet by Adobe themselves.
55+ Hyvä Certificates
The most certified Hyvä agency in the world. Confirmed by Hyvä themselves, twice.
Award-winning solutions
Innovator, World Traveler, and eCommerce Excellence awards across Meet Magento NYC and HIVE London, and more.
Hyvä Platinum Partner
The most-certified Hyvä agency worldwide and the first Hyvä Platinum Partner in the USA. 55+ certified developers and 40+ projects delivered.
ISO certified
ISO 9001 & 27001 for quality and security.
Scrum Alliance certified team
Truly agile team that moves and adapts faster than your typical agency.
Baymard and CXL certified design team
UX grounded in large-scale ecommerce research.
Magebit team at Meet Magento, #1 Adobe Commerce agency worldwide.
The world’s leading Magento agency
By certified developers, Magebit holds the number-one spot among Adobe Commerce agencies worldwide, and we’re the most certified Hyvä agency on the planet. Proof that the depth is real, not a logo on a page.
#1 Adobe agency worldwide
200+ Adobe certifications
#1 Most certified Hyvä agency
Adobe Subject Matter Expert
What a security audit should give you, and rarely does
Most reviews check configuration and stop. The question that matters is whether anyone is already inside.
Magebit audit
Typical agency
Automated tool
Compromise assessment included
Webshells, skimmers, rogue admins, stolen tokens
Every control resolved to Pass or Fail
No third state, nothing assumed clean
Varies
Severity by reachability, not CVSS
Critical findings raised the same day
Sometimes
Findings against your own agency
Shareable with a bank or enterprise reviewer
Sometimes
ISO 27001 practice behind the handling
Sometimes
Learn more
The quiet ones cost the most
Every serious breach I've seen started as something small nobody had time to check. An audit is a week of attention against a problem that otherwise gets found by your payment processor. Tell me what you're running and we'll look properly.
Reviewed by Kristaps Rjabovs
Co-founder of Magebit, Forbes 30 Under 30
Frequently asked questions
If you can't find the answer you're looking for, feel free to reach out to us. We're here to help.
A standard assessment is around 40 hours across application, infrastructure and compromise assessment, quoted as a fixed price before anything starts. Larger estates and complex hosting are scoped on the first call, and a lighter quarterly check against our standard checklist runs at roughly 10 hours. Remediation is always quoted separately, once the findings show what's genuinely required.
Compromise assessment is a core part of the audit: webshell and malware scanning, file integrity, skimmer detection in checkout templates, token and admin review, log analysis and persistence checks. If we find evidence, you'll know the same day, before the document exists.
It's designed to. Agency-side gaps in process, access management or implementation are recorded as valid failures and go into your roadmap like anything else. A typical report contains several. An audit that can't fail its own author isn't worth commissioning.
No. This assesses your application, configuration, access, infrastructure and whether the platform has already been compromised, all read-only and non-destructive. It describes reachable capability rather than demonstrated exploitation. If a pen test is what your situation calls for, we'll say so.
Largely. Hardening, edge protection, execution rules and monitoring reduce exposure substantially, and the report states which target release closes each outstanding advisory, so the upgrade decision is made with real numbers.
AI does the volume work, reading every custom module rather than a sample, comparing your core against the official release, mapping versions and extensions to published CVEs, and searching a month of logs. A certified engineer then decides exploitability, severity and business context, and no finding enters the report without a captured evidence artefact behind it. Your code and configuration stay inside our ISO 27001 practice and are never used to train a model.
None. Every check is a read-only query, a configuration inspection or static analysis. Remediation only happens if and when you commission it separately.
Adobe Commerce (Magento 2) services
Explore the Magento services Magebit has to offer.
Find out what's exposed
Your version, your extensions, your hosting. You'll get findings that stand up to outside scrutiny, and a roadmap priced to close them.
- 1
A certified engineer replies
Not a sales script.
- 2
Critical findings raised immediately
Not held for the report.
- 3
No obligation
The findings are yours to keep.