Services Optimization
Security audits
A structured review of your application and infrastructure for known weaknesses, with findings ranked and fixes recommended.
At a glance
- Includes
- Application review, dependency checks, configuration and access review
- Works with
- Web applications, APIs and the cloud infrastructure behind them
- Delivered as
- A written report with findings ranked by severity and fixes recommended
- Starts with
- An agreed scope and written permission to test
Fit
Is this right for you?
Usually the right call when one of these sounds familiar.
Never reviewed
The product has been live without an outside look.
Before a launch or a sale
Someone is asking whether it has been checked.
Old dependencies
Libraries have not been updated for a long time.
Access that has grown
Nobody is sure who can reach what.
Not the right service? Fixing slow pages: Performance. Finding functional faults: QA & testing.
Scope
Scope and what you get
The review is scoped in writing and reported in plain language. Each piece of work has a matching thing you receive.
- What we do
Application review
The application checked against the OWASP Top 10 and your own risks.
What you receiveRanked findings
Each weakness described, with how it could be used and how serious it is.
- What we do
Dependency checks
Libraries and packages checked for known vulnerabilities.
What you receiveAn inventory of what you use
A list of dependencies with the issues found and the updates needed.
- What we do
Configuration and access review
Cloud settings, secrets handling, roles and permissions reviewed.
What you receiveAccess you can reason about
A clear picture of who and what can reach your systems.
- What we do
Recommendations
Fixes proposed in priority order, with effort and risk stated.
What you receiveA plan to close the gaps
A written list your team can work through, or ask us to.
Use cases
Relevant use cases
Practical situations where this service is put to work. Open a card to see how it applies.
Reviewing an application before launch
A structured check of a new application for common weaknesses before it faces the public.
- Authentication and session handling reviewed
- Input handling and access control checked
- Findings ranked before go-live
Checking dependencies and configuration
A review of the libraries, secrets and cloud settings behind a product that has been live for some time.
- Dependencies checked for known vulnerabilities
- Secrets and configuration reviewed
- Updates listed in order of urgency
Answering a customer's security questions
A written review you can share when a customer or partner asks how your product is protected.
- Scope and method written out
- Findings and fixes recorded
- A report you can share under agreed terms
Sample use cases, drafted as placeholders. The Plethora team confirms the final list.
Process
How it works
Four stops, agreed with you as we go. Each shows what we do and what we need from you.
Scope
We doWe agree what is in scope, what is off limits and how testing will be done, in writing.
You doYou give written permission and name a contact for urgent findings.
Review
We doWe review the application, dependencies and configuration, using tools and manual checks.
You doYou provide access to code, environments and documentation as agreed.
Report
We doWe write up each finding with its severity, evidence and recommended fix.
You doYou read the report and ask us about anything unclear.
Support
We doWe walk your team through the findings and retest the fixes you make.
You doYou decide what to fix and when, and tell us when to retest.
Quality
Quality and handover
How the work is checked, accepted and passed to you.
Written scope and permission
Nothing is tested outside what you have agreed in writing.
Evidence for each finding
So your developers can see the problem for themselves.
Ranked by severity
So the most serious issues are fixed first.
Handled in confidence
Findings are shared only with the people you name.
Tools
Tools and technology
Tools we use in delivery. We choose them to suit your team, and the list does not imply any partnership. Logos belong to their owners.
- OWASP
- Sentry
Engagement
Engagement and cost factors
Ways to work with us
A scoped project
A defined review with a written report and a walk-through.
A team alongside yours
Our engineers work with yours on security as part of delivery.
Ongoing support
Reviews repeated as the product and its dependencies change.
What shapes scope, timing and cost
- How many applications, APIs and environments are in scope
- Whether testing is on live or test systems
- How much code and documentation we can see
- Compliance or customer questionnaires you must answer
- Whether you want help fixing what we find
Scope and cost are confirmed with you in writing before work starts.
FAQ
Frequently asked questions
It is a structured review of your application and infrastructure for known weaknesses. We agree the scope and the methods with you in writing before work starts.
No. The report is a record of what we found and recommend. It is not a certification, and the OWASP Top 10 is a reference we work from.
Yes, if you ask us to. Otherwise your team can work through the recommendations.
We prefer a test environment. If we must test live, we agree the limits and the timing with you first.
Know where you are exposed. Start with a conversation.
Tell us what you run today and we will come back with next steps.
Talk to usRelated