Thinking of getting a pentest? Here's a quick summary of the process.

Agreement process

After you’ve made a decision about the projects we’ll work on together, we will generate some documents for you using Docusign, these will be:

1. Framework agreement - this is the contract between us which lists items including payment terms. It only needs your agreement and signature at the bottom.
2. Penetration Testing Scope - this is the document which lists the requirements for security testing and scope, we will fill in as much of this as we can and can assist you with filling in the remainder.

When these documents are completed we will issue an invoice and contact you to arrange access to your environment and the application. When you have agreed upon a Work Package that suits your needs, we will follow a standard path for the testing to take place and engage with yourself and the development teams as required.

1. Acquire Credentials and Access

Depending on the work package, we may require different credentials and access to your code or infrastructure. Normally these include the following:

• Code Analysis:
  • GitHub/BitBucket
• Infrastructure Testing:
  • AWS/Azure/GCP
• API Testing:
  • API Keys
  • API Paths
• Web Platform:
  • Standard user login details
  • Administrator user login details
• Accessibility:
  • Whitelist VSL IP

2. Start Date

As we all know, development can take on many forms and often runs behind schedule as unforeseen issues occur. We will do our best to remain flexible and ensure that you are happy with your platform before testing commences.Once a date has been agreed and credentials have been provided, we will give you a heads up before proceeding after which we will begin work.Depending on your requirements, we may schedule a progress call for halfway through the testing process to update you on how the testing is going.

3. Complete the Security Report

Once our testing is finished and we are happy with the findings. You will receive a security report per work package purchased. Within the report you will find executive summaries, as well as in-depth analysis of each vulnerability discovered and recommendations on how to improve them and minimise the attack vector of your platform. The security report is yours to do as you wish. It is often shared with team leads and developers to issue the fixes right away depending on their urgency.If required we can provide an additional report for board level meetings, with executive summaries explaining the overall impact on your product/platform and what is required of you in the next steps.