We test your systems the way an attacker would, and show you what to fix.

What we go looking for

Five kinds of hole, drawn as the creatures they are. Each one is a finding from our example report, written against a made-up client, with the rating it got there. Read the sample report

1. The open door

   A way into the admin side of your app that was never meant to be open. In the example report, signing up as a customer with one extra field made the new account an administrator.

   Rated Critical, 9.8

   GP-NWR-01

2. The leaky jar

   An app that hands one customer another customer’s records when asked the right way. In the example report, any customer could read and change other people’s orders.

   Rated High, 8.1

   GP-NWR-02

3. The mimic

   A sign-in that never stops anyone guessing, so someone can keep trying until they get in as one of your customers. In the example report, sign-in and password reset had no limit or lockout.

   Rated Medium, 6.5

   GP-NWR-04

4. The forger

   A field that keeps what is typed into it and later runs it as code in someone else’s browser. In the example report, a customer’s order note ran inside the staff console.

   Rated Medium, 5.4

   GP-NWR-05

5. The old lock

   Software that tells strangers which version it is, so they know which public holes to try. In the example report, the framework and its version showed in headers and error pages.

   Rated Info

   GP-NWR-07

Auditors and regulators can take the report as evidence for ISO 27001 (A.8.8 and A.8.29), SOC 2 (CC4.1), PCI DSS (requirement 11.4), the Central Bank of Sri Lanka’s Technology Risk Management and Resilience Directions, and the security duty in Sri Lanka’s Personal Data Protection Act. A test is evidence toward each of these, not compliance on its own. See which apply to you.