Find the weak spots before someone else does
We test web apps, APIs and cloud accounts the way an attacker would, then explain and fix what we find.
Capabilities
Penetration testing
Web app and API testing against the OWASP Top 10 and your business logic.
Cloud configuration review
IAM, storage, network rules and logging on AWS, Azure or Google Cloud.
Authentication and access
Single sign-on, multi-factor login and roles with Keycloak, Auth0 or Okta.
Secure code review
Review of code that handles money, personal data and permissions.
Smart contract audits
Static analysis and manual review of Solidity contracts before deployment.
Logging and detection
Alerts for suspicious logins, permission changes and unusual traffic.
Good fit if
- A customer or partner wants a security review before signing
- You are about to launch and nobody has tested the app like an attacker
- Access to your cloud accounts has grown without review
Typical use cases
What we use
- Testing
- Burp SuiteOWASP ZAPNmapMetasploit
- Code and contracts
- SemgrepSlitherMythrilDependabot
- Identity
- KeycloakAuth0Okta
- Monitoring
- ElasticSplunkCloudTrailSentry
Four steps, in this order
- 01
Agree scope and rules
- 02
Scan and test by hand
- 03
Report in plain language
- 04
Fix and retest
Do you fix the issues you find, or only report them?
Both. Because we are also a development team, we can fix the findings ourselves or pair with your developers, then retest to confirm each fix.
Will testing affect our live system?
We agree the scope, timing and test accounts in writing before starting. Wherever possible we test against a staging copy, and anything risky on production is scheduled with you.
Can you help us prepare for a compliance audit?
We can review your application and cloud setup against the technical controls that frameworks such as ISO 27001 or SOC 2 expect, and fix gaps. The formal certification itself is issued by an accredited auditor, not by us.
How do we start?
Book a call or send a message describing the problem. We follow up with questions, then send a written scope and estimate. Nothing is billed before you agree to that plan.
Need a security review?
Tell us what you want tested and by when. We will propose a scope and a date.