The question is not whether we can get in.
It is where we start from
Almost nobody is broken into from the outside any more. They are signed into, with a session somebody gave away, and the interesting part is how far that goes afterwards. So we start where a real attacker starts, and we write down every hop.
Four steps, and none of them an exploit
This is what a real one looks like: a session, a repository, a role and a database. Every hop is a permission somebody granted on purpose, which is exactly why it survived every scan the estate had running.
- Step 1Phished sessionOne standard SSO login
- Step 2CI repositoryWrite access to a shared pipeline
- Step 3Deployment rolests:AssumeRole on Resource: *
- Step 4Order databaseRead, from a build container
Four steps, none of them an exploit. Every one is a permission somebody granted on purpose.
Worked examples, written against invented accounts. Client findings never leave the client.
Pick the one that matches what you are actually afraid of
They are not tiers and they do not stack up in order of thoroughness. Each answers a different question, and on the first call we will tell you which one answers yours — including when the answer is that you do not need a test yet.
What somebody with no relationship to you can reach, enumerate and reach through. Starts by finding the estate rather than by being told what it is.
- Every host, service and subdomain that resolves, including the ones outside your inventory
- Authentication on internet-facing services, and rate limiting that is actually applied
- Storage and endpoints left open by a default nobody changed
- Credentials and keys in public repositories, artefacts and paste sites
- Subdomain takeover on records pointing at resources you no longer own
The test that maps to how it actually happens. We are given what a successful phish would give an attacker, and we see how far that goes.
- What a standard user can see, reach and assume across the estate
- Privilege escalation through roles, groups and CI rather than through exploits
- Lateral movement between accounts, subscriptions and clusters
- Reach to production data from a position that was never meant to have it
- Whether any of it generated an alert somebody would have acted on
A workload compromise, played out. Everything a pod can reach, everything the node can reach, and everything the metadata service will hand over.
- Metadata service access, workload identity and token scope
- Container escape, privileged pods and host mounts
- Kubernetes RBAC, admission control and namespace boundaries
- Service mesh policy, and what east-west traffic is actually allowed
- Secrets reachable from the workload, including through the pipeline that deployed it
Your own application, tested as a customer with an ordinary login — including whether that customer can reach another customer’s data.
- Authorisation between tenants, accounts and roles — the failure that matters most in a SaaS product
- Authentication, session handling, password reset and multi-factor bypasses
- Business logic: the sequence of legitimate requests that produces an illegitimate result
- Injection, deserialisation and file handling where they are still reachable
- API surface beyond what the interface exposes, including old versions still answering
Agreed before the window opens, and repeated in the report
“We did not know that was in scope” is the one sentence a test must never produce, from either side.
- Authorisation
- Signed, naming the assets, the accounts and the window, by somebody who can authorise it. Provider notification handled by us where it is required.
- Window
- Agreed in advance. Anything that could affect availability runs when you say, or not at all.
- Data
- We prove access, we do not take copies. Where a record has to be shown to evidence a finding, it is redacted in the report and the original is destroyed on delivery.
- Critical findings
- You get a phone call within the hour. Not a line in a report you read three weeks later.
- Stop conditions
- Any sign of a real intrusion, or anything that risks production stability. We stop and call.
- Afterwards
- Every artefact, credential and piece of evidence is destroyed 30 days after sign-off, and you get written confirmation that it was.
Tell us what you would least like somebody to reach, and we will start there.
Most tests are scoped in a single call. You will get a written window, a fixed price and the authorisation paperwork drafted, and nothing runs until you have signed it.