What we test, and how.
Four engagement types. All fixed price. All delivered with a written report that covers findings, reproduction steps, and remediation guidance.
Web Application Penetration Test
A manual test of your public-facing or internal web application for exploitable vulnerabilities. We do not run automated scanners and call it a pentest. Each finding is manually confirmed and documented with reproduction steps.
- Authentication and session management flaws
- Injection vulnerabilities (SQL, command, LDAP)
- Access control and privilege escalation paths
- Sensitive data exposure and misconfigured headers
- Business logic issues specific to your application
Network and Infrastructure Audit
An assessment of your internal or external network perimeter. We identify open attack paths, misconfigured services, weak credentials, and lateral movement opportunities that an attacker could use after initial access.
- External perimeter scan and service fingerprinting
- Internal network segmentation review
- Active Directory configuration and privilege review
- Firewall and VPN configuration spot-checks
- Known vulnerability identification across services
Security Awareness Training
A structured session for non-technical staff, IT teams, or leadership. We use concrete examples from real incidents — not vendor slide decks — to make the risk legible to people who are not security specialists.
- Password and credential hygiene
- Phishing and social engineering recognition
- Safe use of SaaS tools and cloud storage
- Incident reporting: what to do and who to call
- Optional: Q&A with leadership on current threat landscape
Not sure which engagement fits? A 30-minute call is usually enough to figure it out.
Request a scoping call
Social Engineering Assessment
A controlled phishing campaign and optionally a vishing (voice phishing) or physical access test. The point is not to catch employees out — it is to understand your actual exposure before someone else does it for real.