Cybersecurity

What cybersecurity services do we offer?

We offer four things: penetration testing of web apps, APIs and mobile apps; security audits of code and configuration; secure architecture reviews before you build; and compliance readiness for SOC 2, ISO 27001 and GDPR. Each produces a written deliverable your engineers can act on and your customers or auditors can read.

Service	What we test or review	Deliverable	Typical timeline
Penetration test (web, API, mobile)	Authenticated and unauthenticated testing against OWASP Top 10 and the OWASP API Security Top 10	Report with severity-rated findings, reproduction steps, fixes; retest and attestation letter	1-3 weeks
Web application security audit	Source code, dependencies, auth and session logic, cloud configuration, secrets handling	Prioritized findings, fix plan, dependency upgrade list	1-2 weeks
Secure architecture review	Proposed or existing design: data flows, trust boundaries, auth model, infrastructure	Threat model, design recommendations, checklist for the build team	3-5 days
Compliance readiness (SOC 2, ISO 27001, GDPR)	Controls gap analysis against the framework you're targeting	Gap report, remediation roadmap, policy templates, evidence checklist	2-4 weeks

Because we also build web products, our findings come with fixes, not just screenshots. If you'd rather we fix what we find, that's a separate fixed quote.

How is a penetration test priced for a startup?

Every engagement is a fixed scope and a fixed quote after a scoping call, usually within 24 hours of it. We don't publish a rate card because the price is set by the attack surface, not by a package: the number of endpoints and user roles, whether mobile is in scope, and whether a retest has to land before a deadline. A retest of fixed findings is included in every pen test.

What sets the scope	Why it moves the quote	What you get regardless
Number of endpoints and screens	Each one is tested per role, authenticated and unauthenticated	Severity-rated findings with reproduction steps
Number of user roles	Access-control testing grows with every pair of roles	Fixes written for your stack, not generic advice
Platforms in scope (web, API, mobile)	Mobile adds device storage, deep links and binary checks	Same-day report of critical findings
Deadline	A customer questionnaire or audit date may need a compressed window	Retest of fixed findings and an attestation letter
Grey, white or black box	White box adds code review time; black box adds reconnaissance	Walkthrough call with your engineers

We scope tightly, which is why a startup can afford to test before the enterprise deal rather than after. Ongoing security (quarterly tests, scanning, advisory) runs as a monthly retainer sized to the hours you need.

Pen test vs vulnerability scan: what's the difference?

A vulnerability scan is automated software that matches your system against known issues; a penetration test is a person actively trying to break in using the scan output plus manual techniques the scanner can't do. Scans find outdated libraries and missing headers. Pen tests find broken access control, business-logic flaws and chained attacks.

	Vulnerability scan	Penetration test
Who does it	Automated tool	Security engineer, with tools
Finds	Known CVEs, misconfigurations, missing headers	Logic flaws, access control bypasses, injection, chained exploits
False positives	Many	Verified and reproduced
Output	Long list	Prioritized report with proof and fixes
Cost	Low monthly subscription	Fixed quote per engagement, scoped by endpoints and roles
Satisfies auditors or enterprise buyers	Rarely on its own	Usually required

We run scanners in every test, but the value is in the manual work.

What does a web application security audit cover?

The audit covers the OWASP Top 10 categories, your authentication and session design, dependency risk, cloud and CI configuration, and how secrets and personal data are handled. We review code and infrastructure together because most real breaches cross both.

The OWASP Top 10 (2021 edition) categories we test against:

1. Broken access control (the most common finding in the apps we see)
2. Cryptographic failures
3. Injection (SQL, NoSQL, command, template)
4. Insecure design
5. Security misconfiguration
6. Vulnerable and outdated components
7. Identification and authentication failures
8. Software and data integrity failures
9. Security logging and monitoring failures
10. Server-side request forgery

For Next.js, React Native and Node.js applications we add framework-specific checks: server action and route handler authorization, environment variable exposure to the client bundle, middleware bypasses, JWT handling, Stripe webhook verification, and rate limiting on auth endpoints. For AI features we test prompt injection, data leakage through model outputs and tool-call permissions.

Do you need a pen test for SOC 2 or ISO 27001?

SOC 2 does not require a penetration test by name, but auditors expect evidence of vulnerability management and almost every enterprise security questionnaire asks for a recent third-party pen test. ISO 27001 requires technical vulnerability management (control A.8.8), which a pen test is the standard way to evidence. For both, an annual test plus retest is the practical baseline.

Our SOC 2 readiness work comes before you engage an auditor. We map your controls to the Trust Services Criteria, hand you a gap report, remediation roadmap and policy templates, and run the pen test that becomes evidence. If you already use Vanta, Drata or Secureframe, we feed their evidence collection rather than duplicating it.

How does a penetration test engagement work?

Every engagement follows six steps with a fixed scope and quote agreed up front and a written rules-of-engagement document before any testing starts.

1. Scoping call. What's in scope (domains, APIs, apps, roles), what's out, test accounts needed, deadline. You get a fixed quote within 24 hours.
2. Rules of engagement. Written agreement on testing windows, data handling, emergency contacts and what we will not do (no denial-of-service, no social engineering unless agreed).
3. Testing. Automated scanning, then manual testing by role. Critical findings are reported the same day, not held for the final report.
4. Report. Executive summary for non-technical readers; per-finding severity (CVSS), reproduction steps, evidence and specific fixes for your stack.
5. Fix support. A walkthrough call with your engineers. Optional: we implement the fixes on a separate quote.
6. Retest and attestation. We verify fixes and issue a letter you can share with customers and auditors.

Testing never includes denial-of-service techniques, and where possible runs against staging with production-like data. See products we've built and secured on the projects page.