Transport & infrastructure
TLS configuration, DNS posture, security headers, cookie flags.
Under the hood
How the scan actually works.
OWASP-aligned coverage, a real toolkit, and a penetration tester who checks the work before it reaches you.
What we test
Authentication & sessions
Login flows including SSO, token algorithm and lifetime, session handling.
Authorization
Cross-account and cross-tenant access, tested with more than one login. IDOR and BOLA.
Injection & input handling
SQL, XSS, command and template injection, confirmed against the sink that makes them exploitable.
Exposure & configuration
Content discovery, backup and config files, directory listings, defaults left in place.
APIs & dependencies
Spec-driven testing against the OWASP API Security Top 10, plus known-vulnerable components and secrets shipped in the bundle.
The toolkit
- OWASP ZAP
- nuclei
- sqlmap
- ffuf
- katana
- httpx
- testssl.sh
- Schemathesis
- Playwright
- osv-scanner
- gitleaks
We fingerprint the target before we pick from these. There is no sense running WordPress checks against a Rails app.
Checked by a person
Tools find things. We check whether they’re real.
Scanners throw up a lot that turns out to be nothing, so everything gets re-tested. If we can’t reproduce it, it does not go in the report as a finding. It goes in as a lead, and we say that is what it is.
We also try to combine what we find. One weak spot on its own is often minor. Two of them together can be serious, so we check whether they can be chained into a real attack.
A penetration tester then goes through every finding, checks it against the evidence, and approves the report before it is sent. Nothing goes out automatically.
How far we go is your call
- Passive
- Observation only. No payloads, no writes.
- Active
- We sign in and probe properly, without creating or changing anything. The default.
- Intrusive
- We write data and exploit what we find to prove it is real. Best pointed at staging.
What it is — and isn’t
Technical evidence for ISO/IEC 27001 and SOC 2 workflows. Not a certification, and not a replacement for your ISMS.
It is black-box testing. We work from the outside, without your source code, the same way an attacker would. Someone with the code would find things we can’t, so this doesn’t replace the code review you do internally. Most companies don’t want to hand their codebase to an outside vendor anyway, and we would not either.
And we do not claim more than we did. Anything we could not reproduce is listed as a lead, and a check we could not complete is named in the report with the reason.