Automated Penetration Testing
We all know we should, at least once a year, do a manual pen test. However, most companies are not keen to repeat it due to the cost. So we go a year taking the risk nothing changes!
What if there was a way to keep an eye on our environment and be alerted if anything has changed which needs our attention?
Our cost-effective solution was designed from the ground up to emulate the process of a professional penetration tester to ensure maximum coverage and accuracy.
Our solution takes a first principles approach to application vulnerability detection, and therefore is not bound to any platform or signature database.
Rather than use a database of static signatures, our solution approaches each test in the same way a hacker or penetration tester would and applies a testing methodology. The vast majority of application security flaws, such as SQL Injection and Cross-Site Scripting arise from insecure processing of input supplied by the client. Our solution adopts a first principals approach when testing each input by examining the original expected value and the servers response when the value is modified. By adopting this methodology, we are able to determine how data may be being processed by the server and can then dynamically evolve each test to identify vulnerabilities. This approach results in more accurate testing and allows us to identify security flaws that may be masked by security filters and Intrusion Prevention Systems (IPS), but could still be exploited by a real-world attacker.
