Our Security Testing
Methodology
Enterprise-grade methodology. Transparent scope. Every test category, standard, and tool documented so your procurement and security teams can evaluate with confidence.
Methodology coverage
What we test, what standards we follow, and what checks are included in every engagement.
| Category | Tests Included | Standard |
|---|---|---|
| Web Application | OWASP Top 10, SQLi, XSS, CSRF, IDOR, file upload, auth bypass | OWASP WSTG v4.2 |
| API Security | BOLA, broken auth, mass assignment, injection, rate limiting | OWASP API Security Top 10 |
| SSL/TLS | Protocol version, cipher suites, cert validity, HSTS, CAA | Mozilla TLS Guidelines |
| Security Headers | CSP, X-Frame-Options, X-Content-Type, HSTS, Referrer-Policy | OWASP Secure Headers |
| Subdomain Enumeration | DNS brute-force, certificate transparency, zone transfer | Public DNS Data Only |
| Cloud Configuration | S3 ACLs, IAM policies, public buckets, security groups | CIS Benchmarks |
Web Application
OWASP WSTG v4.2
OWASP Top 10, SQLi, XSS, CSRF, IDOR, file upload, auth bypass
API Security
OWASP API Security Top 10
BOLA, broken auth, mass assignment, injection, rate limiting
SSL/TLS
Mozilla TLS Guidelines
Protocol version, cipher suites, cert validity, HSTS, CAA
Security Headers
OWASP Secure Headers
CSP, X-Frame-Options, X-Content-Type, HSTS, Referrer-Policy
Subdomain Enumeration
Public DNS Data Only
DNS brute-force, certificate transparency, zone transfer
Cloud Configuration
CIS Benchmarks
S3 ACLs, IAM policies, public buckets, security groups
What we don't test
Explicit scope boundaries. No surprises for your team or your vendors.
No social engineering or phishing simulation
We do not send phishing emails, make pretexting calls, or attempt any form of social engineering against your employees. Available as a separate engagement on request.
No physical security testing
We do not test physical access controls, tailgating, badge cloning, or on-site infrastructure.
No denial-of-service testing
We do not perform DDoS, volumetric attacks, or any test designed to degrade or disrupt service availability.
No testing of third-party services outside your domain
We only test assets you own and authorize. Third-party SaaS, CDNs, or payment gateways are out of scope unless explicitly included.
No credential stuffing against your users
We do not attempt credential stuffing, password spraying, or brute-force attacks against your production user accounts.
Tool stack
Industry-standard open-source tools orchestrated by AI. Every scan runs in an isolated Firecracker microVM.
Nuclei
v3.xTemplate-based vulnerability scanning. 9,000+ community and custom templates covering CVEs, misconfigurations, and exposed panels.
Nmap
v7.xPort scanning, service fingerprinting, banner grabbing, and OS detection across TCP/UDP.
SSLyze
v6.xTLS/SSL configuration analysis. Protocol enumeration, cipher suite auditing, certificate chain validation, HSTS and CAA checks.
ZAP
v2.xDAST proxy for web application testing. Active scanning, authentication testing, and session management analysis.
Claude AI
AnthropicFinding validation, false-positive elimination, CVSS scoring with environmental context, business-impact translation, and remediation generation.
Tool versions updated as of May 2026. All tools run latest stable releases at time of scan.
Built for engineering teams
Scan results are structured for developers — not just management reports. Every finding maps to the code layer where the fix belongs.
What a finding looks like
Remediation format
Every HIGH/CRITICAL finding includes a language-specific fix — not a generic advisory.
CVSS Scoring
Every finding is scored using CVSS v3.1 with environmental context — your tech stack and deployment model affect the final score. A vulnerability on an internal-only API is scored differently than on a public endpoint.
False Positive Filtering
Raw scanner output is validated before it reaches your report. Informational noise and known false-positive patterns are filtered out. What you receive are confirmed, exploitable findings with reproduction steps.
Report Format
Reports are delivered as structured PDFs with an executive summary (for management) and a technical annex (for developers) — including per-finding severity, reproduction steps, evidence screenshots, and remediation code.
Integrating findings into your sprint
A security report is only useful if it lands in the right ticket. Here’s how teams typically act on findings.
Triage by severity
CRITICAL and HIGH findings should be treated as P1/P2 bugs — block the next release or schedule a hotfix. MEDIUM findings go into the current sprint. LOW and INFO items go into the backlog.
Map to components
Each finding includes the affected URL, parameter, and HTTP method. Your team can identify the exact route handler, controller, or template responsible without re-running the scan.
Apply the remediation
The technical annex includes language-specific fixes for every finding. For common stacks (Node.js, Python, PHP, Java), the fix is a direct code change — not a wiki link.
Re-test on your next cycle
After fixes are deployed, your next scan will confirm the findings are resolved. Remediation tracking is included in the Full Report, so you can show auditors a closed finding with evidence.
See it on your own domain
Run a free scan using this exact methodology. Summary report in under 2 hours. No credit card required.
Book Your Free Scan