What's covered/01 · Pentesting

Security testing that keeps up with your systems.

Continuous penetration testing and vulnerability scanning help you track what changes as you ship. We combine ongoing scanning with human-led testing and remediation guidance, scoped around your applications, infrastructure, and release process. Start with a focused assessment or an ongoing program.

Illustrative console. Names and counts are example data, not a live engagement.

Continuous coverage, with a defined scope

A new release can change your attack surface. An ongoing program brings scanning, operator-led testing, and follow-up checks into your release process instead of treating security testing as a once-a-year event.

Continuous vulnerability scanning

Repeat automated checks across agreed assets to surface known vulnerabilities and changes that need investigation. A scanner alert is a starting point for triage, not proof that an attacker can exploit your application.

Ongoing penetration testing

Plan human-led testing on a schedule, around releases, or as the agreed scope changes. Operators investigate application behavior and potential attack paths; retesting checks the changes your team makes. Agree the cadence, coverage, and retest terms up front. Continuous does not mean an operator tests every asset every minute.

What your engagement includes

Understand the testing boundary, who owns the work, and what your engineers receive. Those details matter when you compare proposals or need to explain the assessment to a customer.

A named operator

Your engagement has an assigned operator. Testing examines how your application behaves, including access boundaries and workflows that need application context.

- application context

Guidance your engineers can use

Technical findings explain the evidence, impact, and recommended remediation. Your engineers can use the roadmap to prioritize changes; a recommendation is not an applied fix.

- evidence and next steps

A customer workspace

The platform keeps the engagement, findings, and published report together. A completed engagement and a remediated finding are separate records of progress.

- delivery status stays explicit

An agreed testing boundary

Signed authorization defines what we can test. Targets, exclusions, access arrangements, and testing windows belong in the scope before work begins.

- written authorization

Six phases. One bounded engagement.

Authorization comes first. Report delivery and remediation are separate milestones; retesting records whether a change actually addressed a finding.

Phase 01 · gated

Scope & rules of engagement

We agree the targets, exclusions, access, and testing window with your team. An authorized representative approves the rules of engagement before testing starts.

Signed rules of engagement
Phase 02

Recon & surface mapping

We identify the hosts, endpoints, and application roles relevant to the agreed scope. Access limitations affect what can be assessed and belong in the report.

Attack-surface inventory
Phase 03

Exploitation

Operators test for exploitable behavior within the authorized scope. The application and available access determine which attack paths can be investigated.

Testing observations
Phase 04

Proof & evidence

We document the evidence behind findings and their severity. Confirmed behavior must be distinguishable from an inference or a limitation that needs further testing.

Findings with evidence and limitations
Phase 05

Remediation & guidance

The report gives your engineers recommended remediation and a prioritized roadmap. Agree who will implement each change and how it will be checked.

Remediation roadmap
Phase 06 · gated

Retest & verify

Once a change is deployed, retesting checks whether it addresses the finding. A fix is verified only when that check succeeds. Confirm the retest scope and timing in your engagement terms.

Retest result, including open issues

Scope and responsibility in writing.

Decide which systems can be tested and which must stay out of scope. Name an authorized contact, agree when testing can run, and document how to stop it if needed. Testing controls support that agreement; they are not a promise of zero operational risk.

Named responsibility

An assigned operator is responsible for the engagement. Ask who will lead the work and how to reach them during testing.

Bounded by rules of engagement

Written scope sets the authorized targets and exclusions. It also records testing windows and the conditions for stopping work.

Evidence before conclusions

Tools can help investigate a target. The report still needs evidence for its conclusions and must state what could not be verified.

Example scopeillustrative
In scope · allow
+app.acme-prod.com
+api.acme-prod.com/v2/*
+10.4.0.0/22 · staging-vpc
Out of scope · deny
*.acme-corp.internal
prod database · billing
everything not listed above
Illustrative scope only. Your signed rules of engagement define the actual targets, exclusions, and testing conditions.

How to read a technical finding

This illustrative finding shows how evidence, severity, and status fit together. It is not a customer finding or a screenshot of a live assessment.

High

Server-side request forgery in webhook validator

id f7c1a9e2-b04dsource pentestworkspace acme-prod
Triaged

The outbound webhook validator follows attacker-controlled redirects without re-checking the destination, letting a crafted callback URL reach the internal metadata service. Example impact: access to an internal metadata service. In a delivered finding, supporting evidence and reproduction details would explain what was observed. No customer evidence is attached to this example.

Container
api-gateway
Status
triaged
Severity
high
Mapped to SCF NET-06 · Network Security - Network Segmentation. Links this finding to the control it weakens, so your compliance evidence stays honest.
Illustrative finding · example datanot a verified customer result
Status lifecycle
opentriagedfixedverified
Severity scale
criticalhighmediumlowinfo

What is in a penetration testing report?

The report records what was tested, what the assessment found, and what your team should address. An executive summary gives leadership the context; technical findings give engineers the evidence and recommended remediation. Scope and coverage limitations explain where the assessment stops. The remediation roadmap helps organize the next work.

What the report does not prove

A report is a point-in-time assessment of the agreed scope, not a certification or a guarantee that your application has no vulnerabilities. Delivery does not mean every finding is fixed. Retest results should distinguish verified changes from issues that remain open.

Read our customer work

Our published case studies describe work with echowin and the Academy of Charter Schools. They provide customer context without exposing private security reports.

What does your team need to do?

Bring the application you want tested and the requirement you need to answer. If a customer sent a questionnaire or a testing requirement, that is a useful starting point for the scoping call.

Before testing

Identify an authorized signatory and a technical contact. Discuss the target environment, user roles, exclusions, and access constraints. Agree how test accounts and any credentials will be provided securely; do not put secrets in a booking form. Confirm scope, timing, deliverables, and retest terms in writing.

After delivery

Assign engineering owners to remediation, review the recommended changes, and deploy them through your normal change process. Tell the testing team what changed before retesting. If you also need implementation help, make that responsibility explicit in the engagement rather than assuming it is included.

Find out what's actually exploitable.

A 30-minute scoping call. We'll tell you where we'd start, what we'd test first, and what a bounded engagement looks like for your stack - whether or not you hire us.