Penspy is an independent security firm, testing web applications and auditing against the frameworks you answer to.
Most security reports are built to look thorough. The useful ones are built to be fixed — by a developer who has never met the tester, against a deadline someone else set.
That is the only part of our method that never changes. Everything else follows the threat and the standard. Attackers moved from servers to applications and from applications to APIs, so our testing did too. The frameworks moved on — OWASP published ASVS 5.0 and a new Top 10, NIST added Govern to CSF 2.0, PCI DSS v4.0.1 made its future-dated requirements mandatory — so our reports cite the current editions, by number, every time. We hold the tools loosely and the evidence tightly.
The testing is adversarial and creative: chaining small issues, abusing business logic, assuming nothing is off-limits that the rules of engagement allow. The reporting is the opposite — precise, reproducible and dull in the best way. Every finding has the exact request that proves it, so nobody has to take our word for anything.
Your customers ask about SOC 2. Your bank asks about PCI DSS. Your board asks how you compare. So every finding carries its reference — OWASP, ASVS, NIST CSF 2.0, ISO/IEC 27001:2022 Annex A, PCI DSS — and one piece of work produces evidence for all of them, instead of four separate projects that describe the same weakness four ways.
Scanners are good at finding what everyone already knows about. The findings that actually expose customer data — one tenant reading another’s records, a limit that can be raced, a workflow step that can be skipped — need a person who understands what the application is for. We automate the obvious so the people can spend their hours on the rest.
We do not inflate severities to make a report look busy, and we do not bury real problems under “informational”. If something is technically a finding but irrelevant to you, we say so. If a part of the application held up under testing, we say that too — a clean result is a result, and you paid for it.
An engagement is not finished when the report lands. We stay available while your developers fix, review proposed patches when asked, and retest every critical and high finding at no extra charge. The summary letter you show customers reflects what is true after the fix, not what was true before it.
A conversation about what you ship, who is asking for proof, and by when. We agree scope, test accounts, environments and rules of engagement in writing — including what is off-limits and who to call — and fix the price before testing starts.
Manual testing guided by the OWASP Web Security Testing Guide and NIST SP 800-115, with daily check-ins. Anything critical is reported the same day, not saved for the report.
The report, walked through live with your team. Each finding has reproduction steps, a CVSS v4.0 score, its framework references and a specific fix. We stay on call while you remediate.
We retest every critical and high finding and issue a summary letter you can share with customers and auditors. For audits, this is the follow-up review against the roadmap.
Security standards move. A report citing the 2017 OWASP Top 10 or the pre-2022 ISO 27001 controls tells a careful reader the work is out of date. These are the editions we test and audit against today, and why each one earns its place.
Testing time is scheduled in blocks, so the earlier we scope, the more likely we hit your release or audit date. If we are not the right fit, we will tell you that instead of quoting.