Services
Security work, matched to what you actually run
Tell us what you have and what you need. The finder narrows a full catalogue of assessment, engineering, protection and advisory work down to the handful worth a conversation.
- 77services
- 4practices
- 13asset types covered
All 77 services
Assessment & Pentest42
Assessment & Pentest · Web Application
WSTG-Based Vulnerability Assessment
Comprehensive web application security assessment following OWASP WSTG methodology
Assessment & Pentest · Web Application
PWA Security Assessment
Security assessment for Progressive Web Applications (PWA) including service workers and offline capabilities
Assessment & Pentest · Web Application
ASVS Security Verification
Security verification against OWASP ASVS requirements
Assessment & Pentest · Web Application
Penetration Testing (VA+PT)
Comprehensive penetration testing combining vulnerability assessment and exploitation
Assessment & Pentest · Web Application
White-Box Source Code Review
In-depth source code security review with remediation guidance
Assessment & Pentest · API Security
REST API Security Assessment
Comprehensive security assessment for REST APIs
Assessment & Pentest · API Security
GraphQL Security Assessment
Specialized security assessment for GraphQL APIs
Assessment & Pentest · API Security
API Security Verification
API security verification against industry standards
Assessment & Pentest · Mobile Application
Android Security Assessment (MSTG)
Android application security assessment following OWASP MSTG
Assessment & Pentest · Mobile Application
iOS Security Assessment (MSTG)
iOS application security assessment following OWASP MSTG
Assessment & Pentest · Mobile Application
Android Security Verification (MASVS)
Android security verification against OWASP MASVS
Assessment & Pentest · Mobile Application
Mobile + API Combined Assessment
Comprehensive assessment covering both mobile app and backend API
Assessment & Pentest · Mobile Application
Mobile PWA Security Assessment
Security assessment for mobile Progressive Web Applications
Assessment & Pentest · Desktop Application
Windows Desktop Application Security
Comprehensive security assessment for Windows desktop applications including binary analysis, memory corruption vulnerabilities, privilege escalation, DLL hijacking, insecure file operations, registry security, Windows API misuse, and application sandboxing evaluation
Assessment & Pentest · Desktop Application
macOS Desktop Application Security
Comprehensive security assessment for macOS desktop applications including code signing verification, entitlements review, Keychain security, sandboxing evaluation, privilege escalation vulnerabilities, insecure inter-process communication, file system permissions, and Gatekeeper bypass testing
Assessment & Pentest · Desktop Application
Linux Desktop Application Security
Comprehensive security assessment for Linux desktop applications including binary analysis, privilege escalation vulnerabilities, insecure file permissions, SUID/SGID issues, library hijacking (LD_PRELOAD), insecure IPC mechanisms, desktop environment security, and AppArmor/SELinux policy evaluation
Assessment & Pentest · Cloud & Container
Kubernetes Security Assessment
Kubernetes cluster and orchestration security assessment
Assessment & Pentest · Cloud & Container
Container Security Assessment
Comprehensive container security assessment for Docker and containerized applications
Assessment & Pentest · Cloud & Container
Cloud Configuration Review
Review and hardening of cloud infrastructure configuration
Assessment & Pentest · Data & Databases
SQL Database Security Assessment
Comprehensive security assessment for relational databases including MySQL, PostgreSQL, Oracle, Microsoft SQL Server, and MariaDB. Covers SQL injection vulnerabilities, stored procedures security, triggers, views, user privileges, encryption at rest and in transit, backup security, and configuration hardening.
Assessment & Pentest · Data & Databases
NoSQL Database Security Assessment
Comprehensive security assessment for NoSQL databases including MongoDB, Redis, Cassandra, Elasticsearch, CouchDB, and DynamoDB. Covers NoSQL injection, authentication bypass, unauthorized access, data exposure, command injection, misconfiguration vulnerabilities, and access control weaknesses.
Assessment & Pentest · Data & Databases
Cloud Managed Database Security Assessment
Security assessment for cloud-managed database services including AWS RDS, Aurora, Azure SQL Database, Azure Cosmos DB, Google Cloud SQL, Cloud Spanner, and Firestore. Covers Cloud IAM policies, network security groups, VPC configuration, encryption with KMS, backup policies, audit logging, and compliance settings.
Assessment & Pentest · Network Services
VPN Security Assessment
Comprehensive VPN infrastructure security assessment including encryption protocol analysis, authentication mechanisms, access control review, configuration hardening, and vulnerability testing for site-to-site, remote access, and client VPN deployments
Assessment & Pentest · Network Services
Mail Server Security Assessment
Comprehensive security assessment of mail server infrastructure including SMTP, IMAP, POP3 protocol analysis, authentication and encryption review, spam and phishing protection evaluation, configuration hardening, and vulnerability testing for email security
Assessment & Pentest · Network Services
DNS Server Security Assessment
Comprehensive DNS infrastructure security assessment including DNS protocol vulnerability analysis (cache poisoning, DDoS, amplification attacks), DNSSEC implementation review, configuration hardening, zone transfer security, and recursive resolver security evaluation
Assessment & Pentest · Network Services
Identity & Authentication Services
Comprehensive security assessment of identity and authentication systems including IAM platforms, SSO implementations, MFA mechanisms, LDAP directory services, OAuth/OIDC flows, session management, and privilege escalation vulnerabilities
Assessment & Pentest · Network Services
Active Directory Security Assessment
Comprehensive Active Directory security assessment including Kerberos attack paths, privilege escalation, GPO abuse, trust relationships, privileged group review, and AD hardening based on Microsoft and CIS baselines
Assessment & Pentest · Infrastructure
Network Security Assessment
Comprehensive network security assessment including network architecture, protocols, and segmentation
Assessment & Pentest · Infrastructure
Operating System Security Assessment
OS security assessment and hardening review including configuration and patch management
Assessment & Pentest · Infrastructure
Network Equipment Security Assessment
Security assessment of network equipment including routers, switches, firewalls, and network appliances
Assessment & Pentest · AI & Intelligent Systems
LLM Model Security Assessment
Security assessment of Large Language Models including prompt injection, model extraction, and training data leakage
Assessment & Pentest · AI & Intelligent Systems
LLM Application Security Assessment
Security assessment for LLM-powered applications including prompt engineering risks and integration vulnerabilities
Assessment & Pentest · AI & Intelligent Systems
Chatbot Security Assessment
Security assessment for chatbot and conversational AI systems
Assessment & Pentest · AI & Intelligent Systems
AI Agent Security Assessment
Security assessment for AI agents and autonomous decision systems including tool calling and workflow manipulation
Assessment & Pentest · AI & Intelligent Systems
AI Workflow Automation Security
Security assessment for AI-assisted business workflows and automation platforms
Assessment & Pentest · AI & Intelligent Systems
ML Pipeline Security Review
Security review of machine learning pipelines including data handling, model deployment, and inference security
Assessment & Pentest · Blockchain & Web3
Layer-1 Core Protocol Security Assessment
Security assessment of Layer-1 blockchain protocols including consensus, node clients, P2P networking, validators, and chain governance for custom, private, and public chains
Assessment & Pentest · Blockchain & Web3
Smart Contract Security Assessment
Manual and tool-assisted security review of smart contracts including access control, reentrancy, oracle integration, upgradeability patterns, and token standards
Assessment & Pentest · Blockchain & Web3
DeFi Protocol Security Assessment
Security assessment of DeFi protocols including liquidity pools, lending, staking, governance, oracle manipulation, flash-loan risks, and economic threat modeling
Assessment & Pentest · Blockchain & Web3
dApp Security Assessment
End-to-end security assessment of decentralized applications including Web3 frontends, wallet flows, RPC/API backends, and smart contract integration
Assessment & Pentest · Adversary (Red/Purple Team)
Red Team Operations
Full-scope red team engagement simulating advanced persistent threats
Assessment & Pentest · Adversary (Red/Purple Team)
Purple Team Exercises
Collaborative red and blue team exercises
Build Secure17
Build Secure
Secure SDLC Implementation
Implement secure software development lifecycle practices
Build Secure
DevSecOps Setup & Integration
Setup and integrate security into DevOps pipelines
Build Secure
CI/CD Pipeline Security
Integrate security testing and checks into CI/CD pipelines for automated security feedback
Build Secure
Developer Security Training
Comprehensive security training for development teams
Build Secure
Code Review Process Setup
Establish secure code review processes and practices for development teams
Build Secure
Software Supply Chain Security
Secure dependencies, SBOM, provenance, signing, and build integrity across the software supply chain
Build Secure
IaC & Container Build Security
Harden infrastructure-as-code and container build pipelines with policy-as-code and image security controls
Build Secure
AI-Assisted Development Security
Validate AI-generated code and secure AI-assisted development workflows with expert-led, AI-augmented review
Build Secure
AI Coding Policy & Governance
Define policies and guardrails for safe use of AI coding tools across engineering teams
Build Secure
Secure AI SDLC
Design and build secure LLM, RAG, and AI systems from the start with AI-specific engineering controls
Build Secure
Agentic AI Security Engineering
Secure autonomous AI agents, tool-calling, and MCP integrations with permission models and action approval workflows
Build Secure
Security Champions Program
Embed and scale secure engineering practices inside development teams through a structured security champions program
Build Secure
Secure Engineering as a Service
Dedicated secure engineering pod delivering ongoing SDLC, DevSecOps, supply-chain, and AI-native development security on a managed program basis
Protect & Monitor
Continuous AppSec Program
Managed continuous application security program
Protect & Monitor
AppSec Governance Setup
Establish application security governance framework, policies, and processes
Advisory
Secure Architecture Review
Comprehensive security architecture review and recommendations
Advisory
Threat Modeling & Abuse-Case Design
Threat modeling and abuse case analysis for secure design
Protect & Monitor10
Protect & Monitor
WAF Effectiveness Assessment
Assess and optimize Web Application Firewall effectiveness
Protect & Monitor
WAF Tuning & Operations
WAF rule tuning and operational optimization
Protect & Monitor
Continuous AppSec Program
Managed continuous application security program
Protect & Monitor
Attack Surface Monitoring
Continuous monitoring and discovery of attack surface
Protect & Monitor
WAF Profile Design
Custom WAF profile design through comprehensive application recognition, analyzing endpoints and parameters to minimize false positives and false negatives
Protect & Monitor
Security Control Validation
Validation and testing of security control effectiveness
Protect & Monitor
Rate Limiting Validation
Validation and optimization of rate limiting controls to prevent abuse and DDoS attacks
Protect & Monitor
Defense-in-Depth Verification
Verification of layered security controls and defense-in-depth architecture effectiveness
Protect & Monitor
AppSec Governance Setup
Establish application security governance framework, policies, and processes
Protect & Monitor
Vulnerability Management Program
Comprehensive vulnerability management program including discovery, prioritization, and remediation
Advisory12
Advisory
Security Strategy & Roadmap
Strategic security planning and roadmap development
Advisory
Secure Architecture Review
Comprehensive security architecture review and recommendations
Advisory
Threat Modeling & Abuse-Case Design
Threat modeling and abuse case analysis for secure design
Advisory
Governance & Metrics Design
Security governance framework and metrics design
Advisory
Disaster Recovery Plan (DRP) Development
Comprehensive disaster recovery plan development to ensure business continuity and rapid recovery from security incidents and disasters
Advisory
Business Continuity Plan (BCP) Development
Business continuity planning to maintain critical operations during and after security incidents or disruptions
Advisory
Security RFP Preparation & Development
Development of comprehensive security Request for Proposal (RFP) documents tailored to organizational needs and requirements
Advisory
Proposal Evaluation
Expert evaluation of vendor proposals and technical validation of security solution claims to help you make informed procurement decisions
Advisory
Audit & Compliance Support
Preparation of security evidence, gap analysis, and support for regulatory audits and compliance requirements
Advisory
Security Delivery Supervision
Independent supervision and quality assurance for security services delivered by third-party vendors
Advisory
Security R&D Consulting
Execute security R&D projects based on your specific needs and deliver results. Custom security research and development for unique or complex security challenges.
Advisory
Emerging Technology Evaluation
Technical evaluation and risk assessment of emerging security technologies and approaches
The four practices
Each practice has its own page, with the methodology, deliverables and engagement shapes behind it.
Not sure which one you need?
Describe your system in a sentence or two. We will tell you what is worth doing first — and what is not worth paying for yet.