Plenty of testing arrives as a scanner export with a certificate stapled to the front. We test by hand, work from your source where you allow it, and write every finding with the specific change that closes it. Then we retest until it is closed.
You pick the surfaces. Each one has a defined depth, a named standard behind it, and an agreed window. Nothing is tested that is not on the signed scope.
Authenticated and unauthenticated testing of access control, session handling, and workflow abuse. We test every role your users actually hold, not one demo account.
Object and function level authorization, mass assignment, rate limiting, and what your schema introspection hands an attacker for free.
Android and iOS: local storage, certificate pinning, root and jailbreak handling, and the backend the app reaches once you get past the client.
Exposed services, patch level, default credentials, and the forgotten host nobody on your team remembers provisioning.
Lateral movement, Active Directory attack paths, credential reuse, and how far a single compromised laptop gets before anything notices.
AWS, Azure, and GCP. IAM trust chains, public storage, key management, and the logging gaps that would hide an incident from you.
Manual review of authentication, cryptography, and data handling paths, alongside dependency and secret scanning across history.
A named objective, multiple vectors, and a measured answer on detection and response. Phishing and pretexting only where the written scope allows it.
Injection through retrieved context, function and tool abuse, data exfiltration via the context window, and whether an agent can exceed its own authorization.
If an engineer cannot reproduce a finding from the report alone, without calling us, it is not finished and it does not ship.
The exact request, payload, account, and preconditions. Written so someone who was not on the engagement can trigger it on a Monday morning.
Raw request and response pairs, screenshots, and a short capture where the issue only makes sense in motion. Everything timestamped against the test window.
What the attacker actually gains, in your terms: which records, whose account, how much money, how far inward. A severity word on its own is not an impact statement.
CVSS 3.1 base score, and our own rating where your context changes the answer. Where we disagree with the CVSS number we print both and explain the gap.
The specific change: the configuration value, the code path, the policy line. Never a sentence that just says to implement input validation.
We re-run the finding after you fix it. The closure letter lists what closed, what did not, and what you consciously accepted as business risk.
Three documents land at the end: a technical report for the people fixing it, a management summary for the people funding it, and a closure letter after retest for the people asking about it.
Engagement reference, the window, the retest date, the document version, and the named tester who answers for it. Version 1.2 supersedes two earlier issues, and the cover says so.
The CVSS 3.1 base score your auditor expects, and our rating after applying your environment. Where the two disagree the finding explains the gap rather than quietly picking one.
The exact request, the response that should not have come back, the line of code that caused it, and the specific change that closes it. Personal data is masked in the published copy only.
One finding is still open and the document says so. Two were accepted as business risk and stay in the register permanently, because a report that deletes them misleads whoever reads it next year.
It is easier to judge a security firm by what it refuses to do than by what it promises.
Automated tooling is the first hour of an engagement, not the engagement. Where a scanner found something, the report says a scanner found it.
You get a report and a closure letter, both of which we will walk through with your auditor. If what you need is a PDF that says the word secure, we are the wrong firm.
We state which empanelments and certifications we carry and which we do not, in writing, before you think to ask for them.
A signed scope, named contacts on both sides, an agreed window, and a number that reaches a human at two in the morning. Nothing starts until all four exist.
A tester who has built and operated an authentication system writes different advice than one who has only read about them. The same team does both here, and investigates it when something goes wrong.
What happened, in what order, and what left the building. Evidence handled with chain of custody from the first image, written to survive a lawyer reading it line by line.
Forensics →Web, mobile, data, and platform work, including replacing the system everyone is afraid to touch. Auditability designed in at the start rather than retrofitted before a review.
Engineering →Agents with narrow tool permissions, a full log of every run, and evaluation against cases you define. We test the authorization boundary before it reaches your data.
Agents →A scoped web application test is usually five to ten working days of testing plus two days of writing. Network and red team run longer. You get that number in the scope document before you sign, not as a surprise afterwards.
No, but the findings are better with it. Grey-box testing with source and working test accounts finds more in less time than black-box, because the hours go into exploitation instead of guessing at structure. We will work either way and the scope document says which you chose.
If you ask us to in writing, within an agreed window, with a rollback contact on standby. We prefer a staging environment that genuinely matches production. Where a test carries real risk to live data or availability, we say so and we will not run it without you accepting that in writing.
A signed scope and mutual NDA, one named technical contact who can answer questions during the window, test accounts covering each user role, and the window itself. That is usually the whole list.
You get a report that says so, listing the surfaces tested and the depth reached, which is a result you can show an auditor. We do not inflate severity to justify the invoice. A quiet report from a deep test is worth more than a loud one from a shallow one.
The people you meet on the scoping call. We do not pass engagements to a subcontractor, and the name on the report is the person who ran the test and will answer for it.
CobaltLoom