Home
Services
- Threat Modeling »
  Our customized threat modeling
  identifies vulnerabilities within your
  security posture that puts your
  most valuable organizational and
  client data — the crown
  jewels — at risk.
- Security Audits & Assessments »
  Our security audits and vulnerability
  assessments are based on industry
  standards and best practices to assess
  weaknesses in your cloud environment
  and network, as well as mobile
  and web-based apps.
- Penetration Testing »
  Our sophisticated testing services
  delve into your network, smart
  devices and other systems
  to expose critical security
  deficiencies.
Process & Metholodogy
Blog
Careers
About Us
Contact

Guiding You Towards More Secure, Unbreakable Systems.

We exist to make your systems more sound, more secure and more . . . unbreakable. And we are relentless.

We envision a world where the bad guys never win, your system is secure and your most important data and organizational assets are safe. Until that day comes, we work with you to detect your system weaknesses, through the eyes of a hacker. We then attack your systems as an adversary would, while remaining 100% on your team − committed to working with you until your security posture is standing strong. Learn more about our process and methodology and how we can support you in achieving unbreakable.

How We Measure Success

We measure success by how much your security posture improves from start-to-finish. Sure, our consultants love ripping apart your system like a malicious threat actor would, but our goal is to help you improve − not to make you look bad (like so many other security testers). We promise to partner with you to ensure that your project succeeds!
High Level Methodology

We approach our projects from two different angles. First, we apply our engineering and system admin background to understand how your systems were built. Next, we reverse our mindsets to think like hackers do. We think about what mistakes or shortcuts may have been made during development and attack them by using the same tools as hackers.

We've built − and are continuing to update − robust playbooks for many different technologies. These playbooks include extensive documentation on security testing tools and techniques based on our consultants' many years of expertise.

Security Testing Process

What makes us different is our organized, consistent, and thorough approach to our projects. The technical challenge of security testing can be a lot of fun, but many testers lose track of the end goal and become consumed by trying to tackle one specific vulnerability. We have proven, established processes in place to ensure that we stay focused on the right things and cover all of the areas we say we will.

Our consultants layer creativity over their expertise when it comes to chaining attacks to get into your system. Many of our consultants have experience building and managing IT systems at Fortune 500 organizations, so we know where to find the weakest links!

Threat Modeling

A customized threat model will give you a clear picture of the risk posed by attacks against your system or product, so you can make effective decisions regarding the appropriate level of security to incorporate. We facilitate a collaborative, brainstorming threat model session to identify what assets you need to protect and what could go wrong protecting them.

Then we think like malicious threat actors (hackers) and plan how we would actually break into your products or systems. We don't just think in terms of the intended use of your products or systems, we think about how we could abuse them to get to the crown jewels!
Recon

Many security testers want to just jump right in and start looking for vulnerabilities, but we take a disciplined, methodical look around first to make sure we know everything before diving in.

Our thorough reconnaissance phase leaves no stone unturned as we inventory your organization, application, and/or product, looking for potential areas of weakness. Like a detective at a crime scene, we often find clues that don't mean much at first but end up being the key that unlocks the solution!
Vulnerability Discovery

During the vulnerability discovery phase, we sweep through the entire system looking for areas of weakness. We incorporate the knowledge we gained during the threat modeling and recon phases into our attack plan, and break into the system using the same techniques as the hackers.

Our custom-configured vulnerability discovery system, combined with our consultants' tenacity, create the final list of targets to attack. We analyze all of the vulnerabilities we discover to eliminate false positives and ensure they are applicable to you. You will never receive a rebranded automated vulnerability scan report from us!
Exploitation

Once your system's weaknesses are discovered, we use custom-developed and off-the-shelf exploit code to dig deeper into your organization, system or product. This often provides access to areas never intended for public use, leading to the discovery of additional weaknesses and secrets.

We also use proof-of-concept exploits to help demonstrate the feasibility and risk associated with certain vulnerabilities. We find this is a very effective way to gain upper management support for closing your holes!
Reporting

We realize reporting is the most important part of any security assessment. It's one thing to chain several complicated exploits together to gain control over a system, but that act is worthless if your security consultant can't communicate how the attack was executed, what the risk is to you, and how you can reduce the risk of a successful attack.

Our reports clearly explain the issue, how we attacked it, how it might be remediated, and where this risk fits into your personalized threat model. We incorporate an executive summary with a comprehensive technical walk-through (including demos where appropriate) to meet the needs of your diverse audiences.
Remediation Consultation

Now that you have the report, it's important to be able to implement it. We will consult with your management team to help prioritize recommendations, so you can maximize your resources to most effectively reduce your risk.

We will also proactively coach your engineers to help evaluate potential fixes. We want your retest to go as smoothly as possible!
Retesting

Now that you've completed the security test and invested in the resources to fix the issues, how can you assure the project sponsors, executive teams, company boards, and your customers that the risks have been mitigated properly?

During a retest, our consultants will verify that your fixes are sufficient to reduce the risks discovered during the security test. We include this essential step in our process because we believe it's important to give you peace of mind when we're all done. Besides, you put in all that work to make your system more secure, so why not have your final report reflect that? We will leave you with a comprehensive report that clearly resolves all the questions and concerns.

Big Breaks Come From Small Fractures.

You might not know how at-risk your security posture is until somebody breaks in . . . and the consequences of a break in could be big. Don't let small fractures in your security protocols lead to a breach. We'll act like a hacker and confirm where you're most vulnerable. As your adversarial allies, we'll work with you to proactively protect your assets. Schedule a consultation with our Principal Security Consultant to discuss your project goals today.

Process & Methodology

Guiding You Towards More Secure, Unbreakable Systems.

How We Measure Success

High Level Methodology

Security Testing Process

Threat Modeling

Recon

Vulnerability Discovery

Exploitation

Reporting

Remediation Consultation

Retesting

Big Breaks Come From Small Fractures.