// locally built · priced in PKR · for Pakistan's digital economy
⚡ Interactive prototype · seeded with sample data. Every number is illustrative. No live system is queried.
Tip for the talk: open with #demo at the end of the URL to skip this screen.
GHOSTGRID/Demo Logistics sample
◐ scheduled scanSM
Security Posture
sample snapshot · next scheduled scan in 46 min
Why now: Pakistani SMEs lose ₨millions to breaches they can't see — while enterprise security tools are priced in dollars and written for specialists. Ghostgrid is built here, priced in rupees, in plain language.
SAMPLE · ILLUSTRATIVE PROTOTYPE — we're pre-build; this shows the experience our ₨-priced service delivers
64/100
Overall Score
▲ Needs attention
sample baseline
Demo ceiling — full posture needs the live sensor (roadmap).
▲ CRIT — Expired TLS cert on api.demologistics.example
▲ CRIT — SQL injection in /orders search param
▲ CRIT — Open S3 bucket "dl-backups"
■ HIGH — Outdated OpenSSH (CVE-2023-XXXX)
■ HIGH — Missing CSP header on shop site
■ HIGH — Weak TLS cipher on VPN
Findings & Fix Cards
plain-language, actionable · 9 total (3 critical, 6 high)
▲ CriticalF-2041
Expired TLS certificate
api.demologistics.example · HTTPS/443
What (plain language): The website's security certificate expired 6 days ago. Visitors now see browser warnings, and the connection can no longer be trusted.
🔧 Fix (step-by-step):
Use certbot to obtain a free Let's Encrypt certificate (auto-handles key + install)
Deploy it to the API host / reverse proxy
Enable auto-renewal via cron/systemd timer
Re-scan in Ghostgrid — status should turn green
▲ CriticalF-1988
SQL injection in /orders
shop.demologistics.example · search param
What (plain language): The order-search box feeds user input straight into a database query. An attacker can read or dump the orders database.
🔧 Fix (step-by-step):
Use parameterized queries / a safe ORM
Validate input against an allowlist
Apply least-privilege DB credentials
Re-scan to confirm closure
▲ CriticalF-2013
Publicly readable backup bucket
dl-backups (S3)
What (plain language): The storage bucket holding backups is open to the internet. Customer data could be exposed.
🔧 Fix (step-by-step):
Set the bucket policy to private
Enable "Block Public Access"
Turn on default encryption (SSE-KMS)
Audit object ACLs
■ HighF-2102
Outdated OpenSSH
ssh.demologistics.example · SSH/22
What (plain language): The SSH service runs an old version with a known vulnerability. Patch promptly.
🔧 Fix:
Update OpenSSH to the latest stable release
Restart the service
Re-scan to confirm
■ HighF-2110
Missing Content-Security-Policy
shop.demologistics.example
What (plain language): No CSP header, so the site is more exposed to cross-site scripting. Add a policy header.
🔧 Fix:
Define a CSP allowing only trusted sources
Add via server/config
Re-scan
■ HighF-2121
Weak TLS cipher on VPN
vpn.demologistics.example · 1194
What (plain language): The VPN accepts outdated, weak ciphers. Reconfigure to modern ones.
🔧 Fix:
Disable legacy ciphers
Enforce TLS 1.3 / strong suite
Re-scan
■ HighF-2130
Missing security headers (HSTS)
api.demologistics.example
What (plain language): No HSTS header, so downgrade/SSL-strip attacks are possible. Add HSTS.
🔧 Fix:
Add Strict-Transport-Security header
Set max-age >= 1 year
Re-scan
■ HighF-2139
Exposed .git directory
shop.demologistics.example/.git
What (plain language): A version-control folder is publicly browsable, leaking source code. Remove it from web root.
🔧 Fix:
Delete .git from the web root
Block dotfiles via server config
Re-scan
■ HighF-2144
Outdated CMS plugin
shop.demologistics.example
What (plain language): A content-management plugin has a known vulnerability. Update it.
🔧 Fix:
Update plugin to latest
Remove unused plugins
Re-scan
Compliance Readiness
external-control coverage · sample
Coverage of externally-verifiable controls only. Deep internal controls (HR, physical, in-network) require the later-phase sensor module — out of initial scope.
Pakistan's digital economy is growing faster than its defenses. Enterprise security tools are priced in dollars and built for specialists. Ghostgrid is built by young Pakistanis, priced in rupees, and written in plain language — so a generalist IT admin can actually run their own security day to day.
Business model: paid services (scans, advisory, pentest) fund development today; the platform converts that traction into recurring subscription revenue as we ship.
Pricing — in Pakistani Rupees
no FX risk · sample
Western equivalents (Tenable, Qualys, CrowdStrike) cost US$2k–10k/yr — paid in dollars, with FX risk. Ghostgrid is the same capability, priced in ₨.
Starter
₨ 20–30k/mo
Up to 5 assets
Weekly scans
Basic dashboard
most chosen
Growth
₨ 60–90k/mo
Up to 20 assets
Daily scans
Plain-language fix cards
Compliance readiness (external)
Enterprise
₨ 150k+/mo
Custom limits
Continuous scanning
Dedicated analyst
Priority support
All plans billed in PKR. Agency pentest engagements billed separately, fixed-price. Prices shown are sample planning figures.
Who's building it
equal contributors
SM
Sharmeen Mehboob — Submitting Lead
Youth-led cybersecurity collective · certified team, live public footprint, and open-source tooling (SPECTRE, V.E.N.U.S).