CYBER
Why testing misses things
Most breaches are not clever
They are a forgotten subdomain, a token that still works after logout, an internal tool exposed to the internet because a firewall rule was widened for an afternoon in 2023. None of those have a signature. A scanner walks past all of them.
What finds them is somebody with time, motive and permission, working through your systems the way an attacker would — chaining three unremarkable things into one that matters.
That is the whole job. The tooling is ordinary; the thinking is not.
What we test
The systems that would actually hurt
Applications
Authentication, session handling, access control between accounts and tenants, business logic that can be walked backwards. Where the money and the records are.
Infrastructure and identity
Over-broad roles, keys in places they should not be, storage open to the internet, and the CI pipeline that can deploy to production from a pull request.
What you forgot you had
Everything your organisation has published, including the things nobody remembers publishing. Usually the most uncomfortable part of the report.
Phishing and social engineering
Run to find out where the process is thin, not to catch anyone out. Results go to you as patterns, never as a list of names to punish.
The report
Written to be fixed, not filed
Every finding comes with the exact steps to reproduce it, what an attacker gains from it, and a specific fix — not "implement input validation". Severity reflects what it means for your business, so an issue rated critical in a generic table but harmless in your architecture is not sold to you as critical.
You get a summary a board can read and a detail section an engineer can work from, and we will sit with your developers to walk through anything unclear. Retesting what you fixed is part of the engagement, not a second invoice.
How it runs
An engagement, start to finish
Scope and permission in writing
What is in, what is off limits, when we test, and who to ring at three in the morning if something breaks. Signed before anything is touched.
Map the surface
Everything reachable, including what did not appear on the asset list. This is often where the engagement changes shape.
Test by hand, with tools where they help
Automation covers the known ground quickly so the time goes where judgement is needed.
Tell you immediately if it is serious
Anything critical is reported the day we find it, by phone. Nobody sits on a live account takeover until the report is formatted.
Report, walk through, retest
The findings, a session with the people who will fix them, and verification once they have.
Afterwards
A test is a photograph, not a guarantee
It describes your systems on the days we looked. You will ship changes next week. That is why a single annual test tends to produce a certificate rather than security.
Where it makes sense we test continuously instead — watching what you expose as it changes, and looking properly at each significant release. Where it does not, we will tell you a point-in-time test is enough and leave it there.
One commitment
What we do with what we find
Findings belong to you. They are not published, not used as marketing, and not shown to anyone else — including as an anonymised example — without your written say-so. Test data is destroyed when the engagement closes, and we will tell you what we held and when it went.