Walking in is easy. Reaching anything is the nightmare.

Because 3 fields is the price, and we would rather say so. In return you get the whole kit and a notice when it's updated. You see what's inside before you fill anything in.

Two reasons. We message you when the skills change (a new probe, a correction). And one person from NIGHTMARE.sh will message you once, to ask how it went. That's all. Reply "stop" and it stops.

No. We don't sell or share your data. You can leave in one step and ask us to delete it. Our privacy policy is next to the button, not buried in the footer.

The skills require an authorized environment, low request rates and stopping at the first sign of harm. Those rules are on the page before the form.

A checklist is a list. These skills follow the sequence of a real attack and hand you evidence, a fix and a retest for each finding. The page shows an example, marked as fictional.

This is the door in. You get a real tool. We get to talk to people who ran it. When your list of findings outgrows your team's capacity to order it, there's the Assessment.

It was built for SaaS products with a database behind an API, an edge or proxy, a server and containers. It does not cover every stack. The install section lists the tools we have actually tested.

You're not buying a PDF. You're buying the order (what to fix first), the reason, the guidance while your team fixes, and a retest that confirms the fix worked.

A scanner lists. It doesn't know what an attacker would do first in your project, it doesn't sit with your team, and it doesn't confirm the fix.

No. We work in a test environment that you control, with test accounts you create and revoke, under written authorization. Production only if you ask and it's written into the scope. We never ask for passwords, keys or server addresses through this site, by email or in chat.

You get the delivery date in writing, before you pay. If we can't meet the date you need, we'll tell you before you pay.

One retest of the findings you fixed is included. You get a record of what we verified as fixed. New findings from the retest go in the record. They don't open another included round.

That's why the report is ordered: item one matters most. If there's truly no time and no people, that's a sign of 24/7 Protection.

We don't list clients and we don't display badges we haven't earned. What we offer instead is the origin, the method, and the free skills, which you can judge before paying us anything.

Then the report says what is solid, and why. That is also what you show a big customer or an investor. We won't promise a number of findings.

It is. It's for companies where an hour of downtime or a leak costs more than the year. If that isn't you, the Assessment is the right plan, and we'll say so. The monthly fee starts when coverage starts.

Because we accept a limited number of clients and cover only what we've rehearsed on your system. Anyone who sells this in one click hasn't rehearsed anything.

Because improvised response is expensive, and we know that from our own history. First we map your system, apply the Doctrine and write the runbook with you. Then we rehearse it. Then we cover.

Channel, hours covered and time to first action are written into your contract before coverage starts. We don't put on this page a number that isn't in your contract.

Minimum term and notice period are written and shown to you before you sign. No hidden renewal, no surprise penalty. If you leave, you keep everything we built for you: the runbook, the configuration and the documentation. The badge leaves with the protection.

Tools block patterns. They don't respond to incidents. Someone has to decide what to close without taking the service down, and that someone needs a runbook they've rehearsed.

That happened to us, once, in our own origin story. It's the reason nothing is covered before it is rehearsed.

A small, independent firm that takes few clients on purpose. We don't publish a team size, and we won't use words for staff we can't show.