Penetration testing and audit readiness for companies that have to prove their security.
We test web applications, APIs, cloud accounts and networks, mostly by hand. We also prepare companies for ISO 27001, SOC 2, PCI DSS and regional rules such as SAMA, NCA ECC, DORA and the DPDP Act. The same team does both, so the test report is written with the auditor's questions in mind.
Any signed-in user can download another customer's invoices
- Endpoint
GET /api/v2/invoices/{id}/pdf- Impact
- Invoice IDs are sequential. Changing the number returns other customers' names, addresses and billing totals.
- Fix
- Check that the invoice belongs to the caller's account before returning it.
What you can hand to the person asking
- A leadership summary and a retest letter you can share with customers, without the reproduction steps
- A list of what we tested and found sound, which auditors often ask for
- An independent view: we don't give an opinion on controls we designed or implemented for you
Services
Penetration testing
Web and mobile apps, APIs, AWS, Azure and Google Cloud, internal networks and Active Directory. Mostly manual testing.
More on testingAudit readiness
Gap assessment, risk assessment, policies and evidence for ISO 27001, SOC 2, PCI DSS and regional rules. Support during the external audit can be included.
More on readinessVirtual CISO
A part-time security lead on a monthly retainer. Roadmap, risk register, board reporting and customer questionnaires.
More on vCISOManaged vulnerability scanning
Scheduled scanning on the tools you already run, with each issue reviewed by a consultant before it reaches you.
More on scanningThird-party risk
Supplier assessments, and answers to the SIG, CAIQ and custom questionnaires your own customers send.
More on supplier riskOT and ICS security
Assessments against IEC 62443 for plants and utilities, planned with your operations team.
More on OTRisk assessments and training
Standalone risk assessments, DPIAs, secure development training and phishing simulations.
More on trainingWhere are you starting from?
How a test runs
We agree the scope with you first: which applications, environments and user roles, and when testing can happen. During testing we keep your team informed, and we report serious findings as we find them.
The report gives each finding a severity, the evidence, steps to reproduce it and a specific fix. We then go through it with your engineers on a call.
Testing follows OWASP WSTG, ASVS and MASVS, PTES and NIST SP 800-115. The written proposal names who will do the work, and we can sign an NDA before you share details.
One set of controls for every market you sell into
Enterprise buyers ask for ISO 27001 or SOC 2. Regulators add their own rules: SAMA's Cyber Security Framework and NCA ECC in Saudi Arabia, DORA contract terms for ICT suppliers to EU banks, and the DPDP Act and CERT-In Directions in India. We map them to one control set, so the same test report and policies count towards each.
If you have a test, an audit or a security questionnaire coming up, email us a few lines about it. We'll reply with questions or a rough scope.
Email us for a scope