Let's Connect
Media and Support
We are here to contribute to your security and compliance research, articles, events and to support you in your security journey.
Partnerships
Customer driven partnerships make all of us better. Join our partnership network.
Report a Security Issue
We walk the talk, and then some. Help us to continue to improve our security posture.
General Inbox
Have a general question about our pentesting services, augmented security services or pricing?
Simple answers to tough questions
What information do I need to gather in order to get the most accurate scope?
Pricing for pentesting services is based on the scope of the attack surface. This is determined by assessing the number of endpoints, public facing IPs, roles and authentication methods. Check out our Scoping a Penetration Test Document here.
Does active feature development change our penetration testing strategy?
Many clients choose biannual or quarterly Penetration Testing as a Service, to integrate security into their development pipeline. The initial baseline penetration test provides depth of coverage and the subsequent penetration tests address the new features and product developments only. This strategy speeds up security operations and aligns with your product roadmap.
Tell us more about your depth of coverage. How does your comprehensiveness compare to other penetration testing vendors?
We conduct light threat modelling with every penetration test. Our team creates tailored attacks based on your data flow, business logic, integrations, competitive landscape, industry and clients.
In addition to the testing methodology customized to your attack surface, we also map to multiple standards (OWASP Top 10, SANS Top 25, WSTG, ASVS, NIST) for the most in-depth coverage.
How does this help us with compliance?
Our penetration tests can help you meet compliance frameworks such as SOC 2, ISO 27001, PCI-DSS, HIPAA, as well as cybersecurity insurance requirements. All of our application penetration tests include infrastructure testing. This assists in meeting both the infrastructure and application controls required for compliance and provides security assurance.
Within Portal, your data is physically separated, as each of our clients has their own database, given Portal has single tenant architecture. Granular access permissions based on role and project assist clients in meeting compliance and technical risk, aligning to least privilege best practices. Portal has complex password requirements and leverages OAuth for client authentication.
What do your penetration test reports look like?
Our actionable reports include an executive summary, vulnerability descriptions, impact on the business, steps to reproduce and suggested remediation methods. All vulnerabilities are peer reviewed and risk is calibrated according to CVSS and DREAD.
How much remediation support is included?
After the report is delivered, there is an optional read out report meeting with our team to go over the results and assist with remediation. Email and our slack integration is available for quick questions regarding your report. Decision making support on when to eliminate, mitigate, delegate and accept risk is offered to all clients and 3 rounds of retesting is included to support with your SLAs. Penetration Testing as a Service clients benefit from unlimited on demand retesting and 2 hours of security consulting per month.
Here to get you started
15 Risks & Rewards of Pentesting in a Production Environment
The advantages and disadvantages of testing on staging compared to production. Which one provides more value.
The State of Penetration Testing as a Service- 2022 Edition
Say goodbye to 300+ page penetration test reports
Providing the quality of the biggest names in security without the price tag and complications.
Manual penetration testing
Full time Canadian hackers
Remediation support
