We build software, we test it by hand, and we investigate it when something has already gone wrong. Most firms do one of those three and subcontract the rest. Keeping all three with the same people is the entire argument for hiring us, and it is the reason a remediation step here names a configuration value instead of a control family.
CobaltLoom is a small security engineering firm. The people who write production code are the people who run the penetration tests, and they are the people on the call at two in the morning when an incident is live. That arrangement is unusual, it is deliberate, and it changes the output rather than the pitch.
A tester who has shipped and operated an authentication system writes different advice than one who has only read about them. An investigator who has read the codebase already knows which log would have caught the intrusion, and why that log was switched off in the first place. We would rather tell you that than hand you a severity rating and leave.
What we do not do: resell someone else's scanner, pass the engagement to a subcontractor, or put a name on a report that did not do the work.
If an engineer cannot act on a finding without phoning the person who wrote it, the finding is not finished.
The fix in your report has to survive your deploy pipeline, your framework version, and your on-call rotation. We write it knowing that, because we maintain systems under the same constraints.
The tester who ran the engagement is named on the document and answers questions about it afterwards. Eight months later, when your auditor asks what finding 14 meant, you are not writing to a shared inbox.
What we see in forensics is what we go looking for next. An attack path that actually worked on somebody is worth more than another pass down a checklist everyone already runs.
None of this is aspirational. It is the sequence every engagement follows, each step produces a document, and you can hold us to it in writing before you pay anything.
Signed before you describe your systems to us, not after the scoping call. If you need your own paper rather than ours, send it; we read it and redline it ourselves.
Targets listed by hostname, IP range, or repository. Named contacts on both sides, a start and end date, the depth agreed per surface, and a number that reaches a human outside working hours.
A signed authorization to test, from someone with the standing to give it. Where you sit on somebody else's infrastructure, we check their testing rules before the window opens rather than during it.
Technical report, management summary, retest of each finding you fixed, closure letter. The destruction dates for everything we held are written into the scope document before you sign it.
Engagement data sits on full-disk-encrypted machines and in one encrypted store per client, reachable only by the people named on that engagement. Not a shared drive, not a personal laptop, not a screenshot pasted into a chat thread.
Raw evidence, captures, exported data, and anything we pulled out of your systems are destroyed 30 days after the closure letter. We keep the final report and the scope document for 12 months so we can answer an auditor's question about our own work, then those go too. Want everything gone the day the closure letter lands? Put it in the scope and that is what happens.
Test accounts are requested per user role, used only inside the agreed window, and listed in the closure letter so you know exactly what to disable. We ask you in writing to disable them on the closure date, and we say so again if you do not.
Nobody outside the named engagement team. We do not subcontract testing, and we do not reuse your findings as a sales example, anonymised or otherwise, unless you tell us in writing that we may.
Our reports are organised against OWASP WSTG, OWASP ASVS, OWASP MASVS, NIST SP 800-115, MITRE ATT&CK and the CIS Benchmarks, and each finding carries the control reference it maps to. That is a mapping, which tells your auditor what we checked and in what order. It is not a credential and we do not present it as one.
Said plainly, because this is the paragraph most firms blur: CobaltLoom holds no ISO 27001 certificate, no SOC 2 attestation, no CERT-In empanelment, no government clearance, and no vendor partnership tier. This site carries no client logos and no testimonials, and it will not carry any that we have not been given written permission to publish. Where a report says a control is "mapped to" or "aligned with" a standard, it means the finding is written against that standard's control reference so it can be traced — it does not mean we have been audited against it, and we will not let a procurement questionnaire imply that we have. If one of these is a hard requirement for your purchase, say so on the first call and we will tell you we do not qualify rather than consume your evaluation cycle.
Each of these has cost us work at least once. They are still the policy, which is the only reason printing them means anything.
If you are asking for a penetration test when the actual problem is that nothing is logged, we say so on the scoping call and quote the smaller piece of work instead. Before the invoice, not in the debrief after it.
If a payload worked once and never again, that is what the report says, with the evidence and the conditions we think caused it. It does not get promoted to a confirmed critical to make the document look busier.
The list of what we do not hold is above, on our own site, where a competitor can read it. It stays there until it is no longer true.
If the window you need is already committed, you get the next honest date or a pointer to someone else. We do not accept the booking and then quietly thin the engagement to make it fit.
This policy covers cobaltloom.com and the hosts we publish under it. Send the report to [email protected] — the same address published at /.well-known/security.txt. Tell us what you did, what you saw, and enough detail for us to reproduce it. One request and response pair is worth more to us than a page of scanner output.
First reply within three working days, written by a person. A decision on whether we accept the finding within ten. If we are going to miss either, you get told that instead of silence.
Stay inside the rules below and act in good faith and we will not pursue legal action against you, and we will not refer you to anyone else. If you break something by accident while staying inside the rules, tell us and that still holds.
We will name you in the fix note if you want to be named, and leave you out entirely if you do not. We ask before publishing anything, and we do not publish your report without checking with you first.
If we decide not to fix something, you get the reasoning. Where we disagree with you about severity we say why, and you are free to disagree back and publish your view.
Volumetric attacks, resource exhaustion, and anything whose demonstration is that the service stopped working. If you have found a cheap way to take us down, describe it and we will believe you.
Phishing, pretext calls, and anything aimed at a person rather than a system. Our staff are not a target you are authorized to test, and neither are our suppliers.
Tailgating, device theft, and anything requiring you to be somewhere in person. Do not attempt it, and do not treat a lost badge as an invitation.
Automated tooling that keeps running after it has slowed the site down, brute force against live accounts, and bulk fuzzing. Prove the issue with the smallest number of requests that demonstrates it.
Stop at the point the issue is proven. Do not read, copy, alter, or retain data that is not yours, and do not pivot further into our systems to make the report more impressive.
We do not publish a PGP key today. If you need to encrypt before sending, mail the address above and ask for a channel; we will set one up before you send anything sensitive rather than have you post it in plaintext.
This policy authorizes research against our own systems only. It is not permission to test a client's systems, including any client you believe we work with. Client environments are covered by their own written authorizations and testing them without one is not good-faith research.
Every engagement carries one tester's name, so the hiring bar is whether you are willing to defend your write-up a year after you wrote it. Send something you found and the report you wrote about it to [email protected]. We read the write-up first and the CV second, and we will tell you which part was weak either way.
CobaltLoom