You receive evidence validated by specialists and fix priorities tied to the impact on your business, with depth and format defined for your program or project.
Define the scopeWe learn about your product, your business and your objectives to define a tailored scope. We align on assets, access, timelines and limits. Your team authorizes the scope and prepares the necessary access.
Our specialists use proprietary technology to speed up the investigation and deepen the analysis. They verify the evidence and assess the impact of each finding in the context of your product and your business.
We present the results and prioritize fixes by business impact. Management receives the priorities, and the technical team receives evidence and guidance to fix the flaws with the support of proprietary technology.
Your team implements the fixes. We verify the findings in the retest and record progress as set out in the contract.
You receive evidence validated by specialists and fix priorities tied to the impact on your business, with depth and format defined for your program or project.
The risks below affect customer data and contract negotiations. The first item should be fixed before the next release.
An authenticated user can export records from another organization by changing the identifier in the request.
GET /api/v2/orgs/4817/export HTTP/2 Authorization: Bearer <token from organization 2093> HTTP/2 200 records from another organization
Recommendation: validate on the server that the user belongs to the requested organization before generating the export.
Context: the GET /api/v2/orgs/:id/export route does not check whether the user belongs to the requested organization. Task: add the check on the server, before generating the export, and return 403 when the user is not a member. How to validate: repeat the request with a token from another organization and confirm the 403. Then confirm that legitimate members can still export normally.
Your team reviews and applies the change. The retest confirms the result under the contracted conditions.
Illustrative content. Depth and format are defined for your program or project.
Specialists and proprietary technology to investigate vulnerabilities, guide fixes and test the changes in your product. We bring Pentesty's services together in a recurring program, with scope and priorities defined alongside your team.
We select and combine Pentesty's services in a tailored program to investigate risks and keep up with the changes in your product.
An assessment for a specific need, with the services, scope and timeline defined before testing.
Still have questions? Reach us at support@pentesty.co
We offer Web, API, Mobile, Infrastructure and Cloud pentests, automated assessments and Red Team exercises, including adversary emulation, social engineering and phishing. We combine the services in a recurring program or a one-off project, according to the agreed scope.
A Pentest investigates vulnerabilities within a defined scope. A Red Team simulates an attacker's actions to assess how your teams and controls respond. In the continuous program, we review objectives with your team, run agreed campaigns and follow up on fixes. Exercises may combine adversary emulation, social engineering, phishing and physical intrusion.
Our proprietary technology supports the specialists in investigating vulnerabilities and deepening their analysis. They verify the evidence, assess the impact on your product and prioritize fixes according to the risks to your business.
You receive an executive summary and a technical report. Each finding includes evidence, priority and fix recommendations. Your team reviews and applies the changes. We present the results and, for Red Team, the attack paths and how your teams and controls responded to the tests.
Investment, timelines and frequency depend on the systems, risks, objectives and depth of the work. We define services, scope, schedule, deliverables and retest conditions in the proposal before starting.
We start with your business risks and objectives to define which services in our portfolio make sense at each stage. Throughout the program, we review priorities with your team, investigate vulnerabilities and validate the agreed fixes. The combination of services, the frequency of the work and the retests are defined in the proposal.
Yes. If you need to assess a system, investigate a specific risk or carry out a defined exercise, we can structure a one-off project. Scope, timeline, deliverables and retest conditions are agreed in the proposal.
The retest verifies the fixes for the agreed findings. Its inclusion, timeline, number of rounds and limits are defined in the proposal. New assets or significant changes may require a new scope.
The evidence can support audits and compliance assessments. Acceptance depends on the requirement, the scope and the auditor's assessment. The report does not certify compliance or guarantee approval for ISO 27001, SOC 2, PCI DSS or LGPD.
Before execution, we align on authorization, assets, permitted techniques, windows, contacts and stop conditions. Social engineering and physical activities have their own limits. The handling of evidence is agreed with the client.
Talk to our specialists about your product, your risks and your priorities. Together, we define the work that makes sense for your business.
Build my program