Managed security
If it found nothing,
ask what it looked at.
Simulated attacks on your external and internal defenses, run by our own engineers, never a subcontractor. You get the scope in writing, a report you can act on, and a retest to prove the fixes held.
- External testingWhat a test coversWatching
- Internal testingWhat a test coversWatching
- Web application testingWhat a test coversWatching
- Social engineering, when you authorize itWhat a test coversWatching
- No subcontractorsWhat a test coversWatching
- A report you can act on, then a retestWhat a test coversWatching
Foothills Digital—Sentrello Premier Partner
- AWS
- Azure
- Google Cloud
- DigitalOcean
- On-premises Linux
- On-premises Windows
Every one of our people holds active certifications on the platforms they work on.
Sentrello is our only partnership. On the clouds, it's our people who hold the certifications. We don't claim a partner tier, and we'll keep saying so until that changes.
Where this usually starts
You’ve bought one of these before
It came as a PDF with a logo on the cover and a scanner export underneath, and nobody could tell you what to do on Monday.
- The tester wrote the scope, which is why it stopped at the firewall and never touched the VPN.
- Every finding was a version number and a CVE. Not one said what an attacker could do with it at your company.
- The board asked what the report meant. The answer took a week.
- Retesting the fixes? Separate quote.
- It was subcontracted, so the person who found the flaw never spoke to anyone who had to fix it.
What we do instead
Our engineers run it, and we argue about scope first
We don’t resell someone else’s test. The people who agree the scope with you are the ones who run the attack and write the report, which is why it says what happened rather than what a tool printed. A test that finds nothing was usually scoped to find nothing. So we push on the scope: the systems that worry you, the ones you assume are fine, and the ones nobody’s looked at because they belong to a department instead of IT.
How it works
How a test runs
Paperwork comes first. It’s what makes the report usable at the end.
Rules of engagement, signed
What’s in, what’s out, which hours, what happens if we find something live, and who we call. Both sides sign before we send a single packet. The document is short. The conversation behind it isn’t.
External
Everything with a public address. The perimeter, mail, VPN, cloud consoles, and the marketing site that turns out to share a password with something important.
Internal
Assume a laptop’s been compromised or a contractor got careless, and see how far it goes. We can do this remotely or from inside your building, with routine visits across Denver Metro to Colorado Springs and anywhere else by arrangement, travel quoted.
Web apps, and people if you say so
Applications get tested logged in as well as from outside, because the interesting flaws live behind the login. Social engineering happens only when your rules of engagement allow it.
Report, walkthrough, retest
Findings ranked by what we could actually do with them, each with steps to reproduce and a fix. We walk the people doing the fixing through it, then come back and test their work, inside the same engagement.
What a test covers
External testing
Your perimeter as an attacker sees it. Exposed services, mail, remote access, cloud control planes, and addresses you didn’t know were yours.
Internal testing
Starting from a foothold inside, how far can we get? Segmentation, password hygiene, what the file server gives away, and whether the domain falls.
Web application testing
Logged in and logged out, against the app your customers use and the one your finance team does. We look for logic flaws too, not just the ones a scanner recognizes.
Social engineering, when you authorize it
Phishing and phone calls, within the rules you’ve signed. The people who need to know are told. Everyone else gets to react honestly.
No subcontractors
Our own engineers on our own tooling, each holding active certifications on the platforms they work on. The person explaining a finding on the call is the person who found it.
A report you can act on, then a retest
Each finding comes with evidence, what it means for you, and the fix. Detailed for the engineer doing the work, summarized for the board paying for it. The retest is part of the engagement.
Related
Vulnerability Management
Regular scans of your systems and networks, then the bit most programs skip, which is patching what they found. We rank flaws by what an attacker can actually reach, not by the color the scanner painted them.
Incident Response & Digital Forensics
Immediate containment, breach investigation and evidence gathering while the attack is still underway. Set it up as a retainer and your first call is a call, not a contract negotiation, and the cleanup won’t destroy the proof you’ll need later.
Security Awareness Training
Phishing simulations and short training modules, run often and never used as a stick. The number we care about is how many people report the fake, because that’s what saves you when the real one turns up.
What worries you? What are you assuming is fine?
The systems that keep you up at night, the ones that have never been tested, and your last report if you have one.
Send those over and we’ll come back with a scope worth arguing about, and a quote built for it. One-off or on a schedule, there’s no package to squeeze into.
- What we arePlan, create, launch, maintain
- What we areSentrello Premier Partner
- What we areEvery quote written for you