Skip to content

Find the weak spots before attackers do

Cybersecurity

Penetration testing, secure code review and vulnerability assessments for web apps, APIs, mobile apps and cloud. Testing is led by hand, follows published standards and ends with fixes, not just a report.

What we test and fix

Penetration testing

Manual, attacker-minded testing of your web applications and internet-facing infrastructure. We find what automated scanners miss: broken access control, logic flaws and chained weaknesses.

  • Web application testing
  • External infrastructure testing
  • Authenticated and unauthenticated testing
  • Black-, grey- and white-box options

OWASP WSTG, PTES, NIST SP 800-115

  • API and mobile app testing

    REST and GraphQL APIs and iOS and Android apps, tested for authorization flaws, insecure data storage and weak transport security.

    OWASP API Security Top 10, OWASP MASVS, OWASP MASTG

  • Vulnerability assessment

    Authenticated scans of your systems and dependencies. Every result is checked by hand, false positives are removed and the rest is ranked by real risk.

    CVSS v4.0, CISA KEV

  • Secure code review

    Line-by-line review of the code that matters most, such as authentication, payments and data access, backed by static analysis and dependency checks.

    OWASP ASVS, CWE Top 25

  • Cloud security review

    A configuration audit of your AWS, Azure or Google Cloud accounts: identity and access, network exposure, logging, encryption and storage.

    CIS Benchmarks

  • Threat modeling

    Before you build, we map how your system could be attacked and which controls to design in. That costs far less than fixing it later.

    STRIDE

  • Remediation and retest

    We are software engineers as well as testers, so we can fix findings in your codebase, then retest each one and confirm it is closed.

How an engagement runs

Scope a test

  1. Scope and authorize

    We agree targets, test type, timing and contacts. You sign written authorization before any testing starts.

  2. Test

    Testing is led by hand and follows the agreed methodology. Automated tools support it but never replace it.

  3. Report

    Each finding comes with a CVSS score, evidence, steps to reproduce and clear fix guidance. Critical issues are reported straight away.

  4. Fix and retest

    Your team or ours fixes the findings. We then retest them and issue an updated report.

What you get back

  • Executive summary

    Risk in plain language for founders, boards and auditors.

  • Technical findings

    Every issue rated with CVSS v4.0, with evidence and steps to reproduce.

  • Remediation guidance

    Specific fixes for your stack, ranked by priority.

  • Attestation letter

    Confirmation of what was fixed, to share with customers or auditors.

A good fit if you

  • Are about to launch or raise and need a security check
  • Have customers asking for a pentest report
  • Handle personal, health or payment data
  • Want findings fixed, not just listed

Standards we test against

We follow published, industry-recognized methodologies, so you know exactly what was tested and how, and can compare our results with any other assessment.

  • OWASP WSTG
  • OWASP ASVS
  • OWASP MASVS
  • OWASP API Top 10
  • PTES
  • NIST SP 800-115
  • CVSS v4.0
  • CIS Benchmarks
  • CWE Top 25

How we handle your systems

  • Written authorization

    We test only systems you own or are authorized to have tested, and only within the scope you sign.

  • Agreed rules of engagement

    Testing windows, excluded systems and emergency contacts are fixed before we start.

  • Confidential by default

    We sign an NDA on request, encrypt findings in storage and in transit, and share reports only with your named contacts.

  • Deleted after the engagement

    Test data and evidence are securely deleted at the end of the agreed retention period.

Found a vulnerability in our own website? Read our security policy