We attack your systems with your permission, before anyone else does
We simulate a real attack on the assets you choose, prove every finding with evidence, explain how to fix it, then retest to confirm the fix.
Last updated:
Scope
Set for each client by their assets and needs, from:
- Web applications and APIs
- Cloud and infrastructure
- Mobile applications
- Adversary simulation (Red Team): social engineering, and physical testing when relevant and separately authorised.
Method
- Scoping: assets, goals and rules of engagement, with a written, signed authorisation.
- Testing: on the agreed assets, using the OWASP guide that fits each asset type.
- Reporting: findings, impact, severity and remediation steps.
- Debrief: a session walking your team through the results.
- Retest: we confirm the fix closed the finding.
Deliverables
- The agreed scope and rules of engagement.
- A detailed findings report with severity ratings and evidence.
- Remediation recommendations.
- An executive summary for non-technical readers.
- A retest to verify the fixes.
Standards
| Web and API | OWASP WSTG · OWASP ASVS · OWASP API Security Top 10 |
| Mobile | OWASP MASVS · OWASP MASTG |
| Testing method | NIST SP 800-115 · PTES |
| Severity | CVSS |
Questions
What is the difference between a vulnerability assessment, a pentest and a Red Team?
A vulnerability assessment lists known weaknesses. A penetration test proves which can actually be exploited and what that means. A Red Team acts like an attacker looking for any path to a set goal, and tests how well your team detects it.
Can the system go down during testing?
We agree test windows and off-limits areas in advance, and avoid anything disruptive unless you approve it explicitly. For sensitive systems we start in a test environment.
How long does a test take?
It depends on the number and type of assets. We set the duration in a written proposal after the scope assessment.