Security testing that ends with a fix, not a PDF.
Authorized, scoped assessment of your applications and APIs — with findings confirmed by hand and remediation guidance your engineers can act on.
Engagement
Scoped project
Requirement
Written authorization
Output
Findings & remediation plan
All testing is performed only with explicit written authorization from the system owner, within an agreed scope and rules of engagement. Prismelo does not test systems it has not been authorized to test.
Overview
Findings you can trust
Automated scanners produce noise. What matters is whether a weakness is actually exploitable, what an attacker could reach from it, and how quickly it can be closed. Our assessments combine tooling with manual testing, then validate every reported finding before it reaches your team.
Testing is planned around your architecture and your risk. We agree scope, timing, test accounts and escalation contacts in writing before anything begins, and we keep a channel open throughout the engagement so nothing is discovered in a report you receive weeks later.
01
Scope agreed in writing
Targets, exclusions, timing windows and rules of engagement are documented and signed off before testing starts.
02
Validated, not generated
Each finding is reproduced manually and carries evidence, impact and a concrete remediation path.
Capabilities
What this engagement covers.
Scope is agreed per project. The list below is the typical surface area, not a fixed package.
Web application testing
Authentication, session handling, authorization boundaries, input handling, business logic and common vulnerability classes across your application surface.
API security testing
Endpoint enumeration, access control between roles and tenants, token handling, rate limiting, mass assignment and data exposure.
Access control review
Vertical and horizontal privilege checks — the failures that scanners routinely miss and that matter most in multi-user systems.
Business logic testing
Abuse of intended workflows: pricing, approvals, quotas, state transitions and anything an attacker can bend without breaking.
Vulnerability validation
Manual confirmation of scanner output and third-party findings, separating real exploitable issues from noise before they consume engineering time.
Remediation guidance & retest
Fix guidance written for your stack, a walkthrough with your engineers, and verification of remediated issues where included in scope.
Process
How the engagement runs.
A sequence that keeps scope honest and progress visible from the first week.
- 01
Scope & authorization
Define targets, exclusions, environments, accounts and escalation paths. Written approval is collected before any active testing.
- 02
Reconnaissance & mapping
Map the application surface, roles, integrations and data flows to focus effort where risk is highest.
- 03
Manual testing
Work through authentication, authorization, injection, logic and infrastructure boundaries with controlled, non-destructive techniques.
- 04
Validation & triage
Reproduce each issue, remove false positives, and rank findings by exploitability and business impact rather than by scanner severity alone.
- 05
Report & walkthrough
Deliver a findings register with evidence and remediation guidance, then review it live with the team that will implement the fixes.
Deliverables
What you receive.
Everything is written for the people who will use it — your engineers, your leadership and whoever operates the system afterwards.
- Scope and rules of engagement document signed by both parties
- Findings register with severity, evidence and reproduction steps
- Per-finding remediation guidance specific to your stack
- Executive summary written for non-technical stakeholders
- Live walkthrough session with your engineering team
- Retest of remediated findings where agreed in scope
FAQ
Questions worth asking.
Do you need access to production?
Not necessarily. Testing usually runs against a staging environment that mirrors production. When production testing is required, we restrict techniques, agree time windows and work with your team on standby.
How is severity decided?
We use CVSS as a reference point, then adjust for reachability, required access and business context. A finding's priority reflects what an attacker could realistically do, not only a base score.
Will testing disrupt our systems?
Testing is planned to be non-destructive. Techniques with a realistic chance of disruption are excluded by default and only used if explicitly authorized and scheduled.
Which testing types are out of scope by default?
Social engineering, physical intrusion, denial-of-service and testing of third-party systems are excluded unless separately agreed and lawful. We will say so plainly if a request falls outside what we can do.
Do you sign NDAs?
Yes. We can work under your NDA, and we treat all assessment material as confidential by default.
Related
Often engaged together.
02
Cloud & Hosting
Infrastructure planning, deployment and hosting architecture built for reliable, understandable operation.
03
Software Development
Custom software, backend systems, API design and integrations built for long-term maintenance.
04
AI Solutions
Applied AI features, workflow automation and integrations designed around measurable tasks.
Have a scope in mind?
Tell us what you are working on and we will tell you honestly whether penetration testing is the right starting point.