SECTION OVERVIEW
Your systems believe they’re secure. We test whether that’s true.
Manual, adversarial security testing for businesses in the Philippines — three depths of engagement, a fixed scope agreed in writing, every finding verified by a person before it reaches your report.
An attacker needs one working path in. You have to defend all of them. That asymmetry doesn’t go away because a system has shipped without incident so far — it just means the gap hasn’t been found yet, by someone willing to report it.
HOW AN ENGAGEMENT RUNS
Six phases
Scope & rules of engagement
We agree on targets, testing windows, and what’s off-limits before anything starts.
Reconnaissance & mapping
We map the real attack surface — including what you may not know is exposed.
Testing
Manual testing across all 15 categories, augmented by Hiraya for coverage and speed.
Verification
Every finding is manually confirmed. Nothing goes into your report on a scanner’s word alone.
Reporting
Severity-ranked findings with reproduction steps and concrete remediation guidance.
Retest
Once you’ve fixed what we found, we confirm it’s actually closed.
DEPTH OF ACCESS
Three depths of access
Choose how much access we get before we start. More access finds more, faster — but even without credentials, we find what an outside attacker would.
Blackbox
Outside in
No credentials, no source. We test the way an opportunistic attacker would — from the outside, against what’s actually exposed.
Graybox — DAST
Authenticated depth
Working logins for each role, without source access. Dynamic testing against the running application catches what only shows up at runtime — broken access control between roles, session handling, business logic.
Whitebox — SAST
Source-level review
Read access to the repository. We analyse the code directly, tracing an issue to the exact function rather than inferring it from behaviour.
Engagements run either as a onetime assessment or as a retainer covering continuous testing on the same scope. Either way the work is quoted against your scope. Ask us for a quote.
GO DEEPER
The detail behind an engagement
What we test
Fifteen attack categories — injection, identity, infrastructure and data exposure — checked on every engagement regardless of tier.
Read more ↗
Hiraya, our testing platform
Wider, faster coverage across an engagement, with every candidate finding still reproduced by a person before it is reported.
Read more ↗
Data Privacy Act (RA 10173)
The statute in full, for engagements where personal or sensitive personal information is in scope.
Read more ↗