FAQs

White box testing uses full access to source code, architecture and documentation. Grey box testing uses partial knowledge such as user accounts and API documentation. Black box testing starts with no inside knowledge, like an external attacker.

An executive summary, detailed findings with CVSS and business risk ratings, proof of exploitation for validated issues, and developer-ready remediation guidance with code examples.

Threat modeling is a structured review of a system's design. We identify threats using STRIDE, rank the risks and plan the mitigation. It is most useful when a system is being designed or changed.

It starts with a scoping call, followed by written rules of engagement, kickoff and access, and then the assessment. The same path applies to every service.

Surfacia is our attack surface management platform. It runs reconnaissance on a target domain and builds a target fingerprint. Sentiness is agentic security: AI agents that dig deeper for vulnerabilities and validate them using that fingerprint. Sentiness can also be used on its own with fingerprints or digital assets you provide.

Yes. Use Get a sample report, choose the report you want and give us your email, and we will email it to you.

If you are not sure what scope you need, contact us and we will help you choose the right assessment.

Rules of engagement are agreed in writing before testing starts, including who should see findings. If you have specific confidentiality requirements, tell us during scoping.