sidebored_

Penetration testing · Cloud-native security · Compliance

We break in first, so attackers don't.

Sidebored.io is a security firm run by practitioners. We test networks, applications and Kubernetes platforms the way a capable attacker would, then help you fix what we find and prove it to auditors.

Scope an engagement See services
  • CISSP
  • CREST CRT
  • CREST CPSA
  • CKS — Certified Kubernetes Security Specialist
  • Master's in Cybersecurity, Brown University
  • Hack The Box — Omniscient
  • Upstream commits: Linux kernel · KubeVirt · Cilium
  • Attorney — security & compliance

Services

What we test and advise on

01

Network Penetration Testing

External and internal network testing by CREST-registered testers. We find the path from the internet or a foothold to the systems that matter.

Details → 02

Web & API Application Testing

Manual testing of web applications and APIs, focused on authentication, authorization and business logic — the flaws scanners do not find.

Details → 03

Kubernetes & Cloud-Native Security

Cluster and platform assessments from CKS-certified engineers who commit upstream to KubeVirt and Cilium.

Details → 04

Linux & Virtualization Security Review

Security review of Linux-based products, appliances and virtualization stacks by engineers with commits in the Linux kernel.

Details → 05

Security Compliance & Audit Readiness

Testing and readiness support for SOC 2, ISO 27001, PCI DSS and HIPAA, with a security and compliance attorney on the team.

Details → 06

Security Program Advisory

CISSP-led advice for teams that need senior security judgement without a full-time hire: risk assessment, architecture review and planning.

Details →

How an engagement runs

  1. Scope. A short call to agree on targets, rules of engagement, test windows and emergency contacts. You get a written scope and quote before work starts.
  2. Test. Manual testing by experienced practitioners, supported by tooling — not a scanner export with a cover page.
  3. Report as we go. Critical findings are reported the day we confirm them, so you do not wait for the final report to start fixing.
  4. Deliver. An executive summary, and technical findings with reproduction steps, evidence, risk ratings and specific remediation guidance.
  5. Retest. We verify your fixes and issue an updated report you can hand to customers and auditors.

Have a scope in mind?

Tell us what you need tested. We reply with questions and a proposed scope.

Start the conversation