OUR TESTING PLATFORM
Hiraya
Tagalog for aspiration — the gap between what you believe about a system’s security and what’s actually true about it. It’s also what our testers run on every engagement.
Built in-house
Written and maintained by the same people who use it on client engagements — not licensed from a third party we can’t fix.
Human-verified
Every candidate finding is confirmed by a tester before it’s reported. Hiraya widens what we can look at; it doesn’t decide what’s real.
Fifteen categories deep
Covers the same fifteen attack categories in every engagement, from injection to dangling DNS to PII exposure.
WHERE HIRAYA EARNS ITS KEEP
Some engagements need it more than others
It matters most when the scope is too complex for manual testing alone to cover within the timeline.
Complex, multi-role applications
Several user roles with different permissions · Deep authenticated flows a scanner alone can’t navigate · Best suited to a graybox engagement
Large, sprawling attack surfaces
Many subdomains, some of them forgotten · Higher risk of dangling DNS and takeover · Hiraya maps the surface before testers go deep
Regulated, data-sensitive environments
Systems holding personal or financial data · Data Privacy Act (RA 10173) exposure in scope · Findings documented to hold up to a compliance review
COMPARISON
Hiraya-assisted vs. the alternatives
| Hiraya-assisted | Automated scanner alone | Manual-only testing | |
|---|---|---|---|
| Every finding human-verified | Yes | No | Yes |
| Coverage across a large surface | Yes | Yes | Limited by time |
| Understands business logic & auth flows | Yes | No | Yes |
| Fixed, reproducible scope & timeline | Yes | Yes | Varies by tester load |
| False-positive rate in your report | Near zero | High | Low |
AUDIT & CERTIFICATION
Testing for ISO 27001 & PCI DSS
If a certification or a QSA is the reason you’re testing at all, the report has to hold up to someone else’s checklist, not just your own team.
ISO 27001
Annex A.8.8 (Management of technical vulnerabilities) expects regular, documented vulnerability testing feeding into your risk treatment plan.
Scope & methodology against your SoA
We map the engagement to the controls you claim in your Statement of Applicability, so the report lines up with what your auditor will actually ask for.
Severity ratings auditors can cite
Findings come with clear severity, evidence, and remediation status your auditor can reference without translating our notes into theirs.
Best fit: graybox, before surveillance
Authenticated graybox gives the coverage ISO auditors expect without needing full source access. Run it annually, or ahead of your surveillance audit.
PCI DSS
Requirement 11.4 requires periodic penetration testing of the cardholder data environment, including segmentation testing, plus retesting after significant changes.
External and internal paths into the CDE
Both outside-in and inside-the-network testing of systems that store, process, or transmit cardholder data, so a QSA sees the full attack path.
Segmentation testing, scoped on its own
If segmentation is how you shrink PCI scope, 11.4 requires proving those controls hold. We scope that separately so the evidence stands on its own.
Best fit: graybox or whitebox, with retest
Deeper access finds CDE issues faster. Every engagement includes the retest step 11.4 expects after significant findings or changes.
WHY WE BUILT IT THIS WAY
Why we don’t ship raw scanner output
We’ve watched a scanner report accounts that didn’t exist.
Automated username and profile checkers returned plausible-looking matches with nothing real behind them. The fix wasn’t a smarter scanner — it was requiring a second, independent check before anything is called a finding.
Hiraya carries that discipline into every engagement. A candidate finding only becomes a reported finding once a tester has reproduced it.
That is slower than trusting the first scan. It is also why our reports don’t waste your engineers’ time.
admin panel exposed at /admin-consolePath returns 404 on manual request. No panel exists.valid account enumerated: j.santosLogin attempt fails; the account was never registered.upload endpoint accepts .phpReproduced. Uploaded file executed as www-data.Two of three candidates above never reach the client. Nothing is written up until a tester has reproduced it — and if we can’t prove it, it doesn’t go in the report.