A security review before an enterprise procurement round
A growing SaaS product facing its first serious security questionnaire from a prospective enterprise customer.
This is an illustrative placeholder. It shows how we scope and document an engagement. It is not a delivered client project, the client is a generic sector descriptor, and the outcomes below are described qualitatively because there are no real metrics to report.
Problem
The product had grown quickly and no external party had ever tested it.
Access control had been added per-feature over two years, with no central model.
A procurement questionnaire was due and the team had no evidence to attach to it.
Approach
Ran an application penetration test against the OWASP Top 10 and OWASP ASVS, plus a secure code review of the authorisation layer.
Prioritised findings by exploitability in their actual deployment rather than by raw scanner severity.
Retested after remediation and issued an updated report the team could take into procurement.
Outcome
Authorisation moved from per-feature checks to one reviewable policy layer.
Findings were remediated and confirmed closed on retest.
The team went into procurement with a current report instead of an assurance.
Tell us what you're building
A short call, a direct answer on whether we're the right fit, and a written scope if we are. No pitch deck.
Ahmedabad, Gujarat, India