Services / 03 — Software Assurance & Security
Find the weaknesses before they become incidents.
Independent technical assurance for the software you run, built by you, by a vendor, or by AI. Prioritized findings and a remediation plan your engineers can act on.
Sc. 01 — The offer
Independent, technical, and specific.
Every assessment is scoped, authorized and priced to stand on its own. If you want help fixing what we find, that's a separate decision.
Application security review
Authenticated API and access-control testing, configuration and secrets review.
Production readiness
Architecture, observability, failure handling and deployment controls, assessed before launch or scale.
Authorized penetration testing
Within the competence and certification scope of the team members performing it.
Findings you can act on
Risk severity, evidence, a technical remediation plan and an optional remediation engagement.
Sc. 02 — Process
From scope to a plan you can act on.
- Act I
Scoping
Systems, boundaries, test windows and authorization, agreed in writing.
- Act II
Authorized review
Technical testing within the agreed scope and the testers' certification scope.
- Act III
Prioritized findings
Risk severity, evidence and impact for each finding.
- Act IV
Remediation plan
Clear technical fixes, with an optional remediation engagement.
Sc. 03 — Transparency
What’s yours stays yours.
Client-owned systems, test artifacts and the audit evidence you need remain accessible to you under contract, with clear terms on deliverable ownership, confidentiality and permitted testing.
- You receive
Scope & limitations
Exactly what was tested, how, and what was out of scope. - You receive
Findings & evidence
Each finding with its risk severity and the evidence behind it. - You receive
Remediation plan
Prioritized, technical, and written for the engineers who will fix it. - You receive
Credentials & authorization
Who tested, under which authorization, within which certification scope.
Sc. 04 — Focused assessment
Your employees built an app. Is your company data safe?
AI coding tools and low-code platforms let anyone ship an internal app. We assess the ones that handle personal, financial or customer data.