Upload Security

Manual penetration testing & vulnerability research

A finding is only real if we can prove it.

We test web applications, networks, and embedded devices by hand. Every issue we report arrives with the request that triggered it, the access it grants, and the change that closes it — so your engineers can reproduce it before they read the summary.

Read a sample report
Tests delivered
250+
Average start
72 hours
Testing by hand
100%
Finding 03 / 14 Critical

Broken object-level authorization

Component  GET /api/v2/users/{id}
CVSS v3.1  8.1 — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Evidence
# session: user 5570 (standard tier)
GET /api/v2/users/4192 HTTP/1.1
Authorization: Bearer eyJhbGciOi…

HTTP/1.1 200 OK
{"id":4192,"email":"…","api_token":"…"}
Impact

Any authenticated account can read every other account's profile, billing email, and live API token by incrementing one integer. Enumerated 4,100 records in nine minutes.

Remediation

Authorize on the owning record, not the route. Scope the query to the session's tenant and rotate every token exposed during the window.

Reported day 4 · fixed day 9 ✓ Closed at retest

Illustrative entry — the format every client receives.

Services

What we test

Four engagement types, each run by hand against a threat model we agree with you first. Scanners are a starting point for coverage, never the deliverable.

Web & API

Web application testing

Deep manual testing of applications, SPAs, and the APIs behind them, with the multi-step logic abuse and chained authorization failures that automated coverage reports as clean.

  • Authentication & session handling
  • Authorization & tenant isolation
  • Business logic abuse
  • REST & GraphQL surface
Perimeter

External network testing

Your estate from the outside, the way an unauthenticated attacker sees it. We map what is reachable, then work out what it costs you if any single service gives way.

  • Attack surface enumeration
  • Exploitation & access validation
  • VPN & remote access review
  • Cloud configuration review
Internal

Internal network testing

Assumed breach. Starting from one foothold, we follow the same path an operator would to domain compromise — and show exactly which control would have stopped it.

  • Active Directory assessment
  • Privilege escalation paths
  • Lateral movement
  • Segmentation validation
Product & device

Product penetration testing

Testing the thing you built, not the network it sits on. We take the device or product apart — firmware, radios, companion app, and the cloud API behind it — and report against the whole chain. This is the work our published CVE research comes out of.

  • Firmware extraction & analysis
  • Hardware & debug interfaces
  • Companion app & pairing flows
  • Device-to-cloud API testing
SaaS FinTech HealthTech E-commerce Connected devices

Engagement

What the four weeks look like

Days are indicative for a standard application test and are fixed in the statement of work before anything starts. Critical findings never wait for the report.

Day 0

Scoping

One call on architecture, threat model, and compliance driver. You leave with a fixed scope and a fixed price.

Days 1–10

Testing

Hands on keyboard. Anything critical reaches your Slack or Teams channel the day we confirm it, with the reproduction attached.

Day 12

Reporting

An executive summary your board can read and a technical section your engineers can work from, ranked by real exploitability.

Within 30 days

Retest

We verify each fix and reissue the report with findings marked closed. Included, not billed.

Compliance

Reports that satisfy the auditor

Each engagement produces the evidence these frameworks ask for, mapped to the control it answers, so you can hand it over without a translation layer.

Framework coverage
Framework Requirement it answers Reference
SOC 2Risk identification and ongoing monitoring of security controlsCC4.1 · CC7.1
ISO 27001Management of technical vulnerabilitiesA.12.6.1
PCI DSSExternal and internal penetration testingReq 11.4
HIPAASecurity risk analysis of systems handling ePHI§164.308(a)(1)
GDPRRegular testing of technical security measuresArt. 32(1)(d)
CCPAReasonable security procedures for personal information§1798.150
NIST CSFIdentify, Protect, Detect outcomesID.RA · DE.CM
NIST 800-53Penetration testing controlCA-8

Why teams keep us

Four things we refuse to compromise on

Manual first, always

Every finding is validated by a person who exploited it. You will not receive scanner output with our logo on the cover, and we will tell you plainly when a test comes back quiet.

Criticals leave the same day

Anything critical goes to your channel the day it is confirmed, with the reproduction attached. Nobody should learn about an exploitable flaw from a PDF three weeks later.

Reports written for engineers

Exact requests, response diffs, and working proof-of-concept code. The fix is described in terms of your code, not as a link to a generic advisory.

Retesting is part of the job

We verify your fixes within 30 days at no extra cost and reissue the report. Finding the vulnerability is half the work; confirming it is gone is the other half.

Tell us what you are shipping.

Scope and price back within 24 hours. Most engagements start inside 72 hours of signature.

Read a sample report