Approach
Manual testing, clear reports, verified fixes.
Automated scanners find the obvious. The findings that matter come from people who understand how systems fail — and who can explain the fix to your engineers.
Methodology
Our testing follows recognized methodologies — including the OWASP Web Security Testing Guide, the OWASP API Security Top 10, PTES and NIST SP 800-115 — adapted to your environment and threat model. Kubernetes work references the CIS Kubernetes Benchmark and the NSA/CISA Kubernetes Hardening Guidance.
Rules of engagement
Before testing starts we agree in writing on:
- Targets in and out of scope, and the source IP addresses we test from
- Test windows, and any systems that must not be disrupted
- Escalation contacts on both sides, available during testing
- How we handle sensitive data we encounter
Reporting
Every report contains:
- Executive summary — overall risk, key themes and priorities, in plain language
- Findings — each with a severity rating, affected assets, reproduction steps, evidence and remediation guidance
- Positive observations — controls that held up, so you know what not to change
- Retest results — status of each finding after remediation
Handling your data
We collect only the evidence needed to demonstrate a finding, limit access to the engagement team, and agree retention and deletion terms with you during scoping.
Legal and compliance context
Testing is authorized in writing before it begins. Our team includes an attorney focused on security and compliance, so authorization, third-party hosting terms and disclosure obligations are addressed during scoping rather than after an incident.