Catalyic Security

BACKGROUND

Please describe your company and position.

I am the Director SEPG & PMO of Techlogix Pakistan

Describe what your company does in a single sentence.

Techlogix helps companies use innovation and emerging information technologies to digitally transform their business

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Catalyic Security to accomplish?

• ISO 27001 Consultancy
• Vulnerability Assessment
• Penetration Testing

SOLUTION

How did you find Catalyic Security?

• Referral
• Long term association since 2001

Why did you select Catalyic Security over others?

• High ratings
• Close to my geographic location
• Pricing fit our budget
• Great culture fit
• Good value for cost
• Company values aligned
• Expertise and Experience, Certified Professionals

How many teammates from Catalyic Security were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

Gap Analysis:Review the organization's current security practices.
Identify gaps between existing practices and ISO 27001 requirements.
Provide a detailed report highlighting areas for improvement.
Risk Assessment:Identify security risks to the organization’s information assets.
Develop a risk treatment plan, including controls aligned with ISO 27001 Annex A controls.
ISMS Documentation:Develop or update ISMS documentation, including the Information Security Policy, Risk Management Procedure, and Statement of Applicability.
Assist in creating other necessary procedures and records, such as incident management, access control, business continuity, and asset management.
Training and Awareness:Conduct training sessions for employees on ISO 27001 principles and the importance of information security.
Raise awareness of roles and responsibilities regarding information security.
Internal Audit:Perform a pre-certification internal audit to ensure compliance with ISO 27001 standards.Provide guidance on addressing non-conformities identified during the audit.
Assistance in Certification Audit:Prepare the organization for the certification audit by the external certification body.Provide support during the external audit, including clarifications and corrective actions as needed.

Web Applications: Websites, web portals, and web-based applications.
Network Infrastructure: Firewalls, routers, switches, servers, and other networked devices.
Mobile Applications: iOS and Android apps associated with the business.
Endpoints: Desktops, laptops, and other endpoint devices.
APIs and Web Services: APIs used by web and mobile applications.
Cloud Infrastructure: Cloud-based assets, including storage, compute, and network resources.
In-Scope IP Addresses and Domains: A list of IP addresses, domains, or hostnames that are approved for testing.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

Stakeholder and Customer Satisfaction, Risk Assessment and Treatment Metrics, Risk Reduction, Compliance and Audit Success Rates, Improvement in Security Controls and Policies, Awareness and Training, Incident Response and Recovery Times, Documentation and Record Accuracy, Monitoring and Improvement Indicators, Cost Reduction in Security Management

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Their project management was highly effective, characterized by clear communication, timely updates, and a strong adherence to the project timeline. They consistently delivered items as scheduled, and any minor delays were promptly communicated with proactive adjustments to keep the project on track. They responded well to our needs, adapting deliverables based on our feedback and showing flexibility to accommodate changes. Overall, their approach was collaborative and responsive, ensuring that our requirements were met with high-quality outcomes.

What was your primary form of communication with Catalyic Security?

• In-Person Meeting
• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

What impressed me most about this company was their deep expertise combined with a customer-centric approach. They consistently went beyond standard practices, tailoring their solutions to meet our specific needs and providing practical, actionable insights rather than generic advice. Their ability to stay flexible and responsive, even in challenging situations, demonstrated their commitment to delivering real value. This unique blend of technical skill and genuine partnership made them stand out.

Are there any areas for improvement or something Catalyic Security could have done differently?

While Catalytic Security provided excellent service, one area for potential improvement could be enhancing proactive communication during quieter phases of the project. More frequent, brief updates—even when there were no major developments—would have helped keep us more closely engaged and aligned. Additionally, a more detailed post-project follow-up could further support the implementation of their recommendations and demonstrate their commitment to long-term success.

BACKGROUND

Please describe your company and position.

I am the President/CEO of Ritenet Corp

Describe what your company does in a single sentence.

Trust Advisor to the Federal Gov.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Catalyic Security to accomplish?

• ISO 9001

SOLUTION

How did you find Catalyic Security?

Referral

Why did you select Catalyic Security over others?

• High ratings
• Pricing fit our budget
• Great culture fit
• Good value for cost
• Referred to me
• Company values aligned

How many teammates from Catalyic Security were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

We hired them to help us get ISO 9001 Certification. They were very thorough and professional and helped us put the process in place in record time and get our certification. We have hired them to do ISO27001 certification now.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

• Project plan
• Timeliness
• When our team was slow they were able to pick up some of our slackness and kept the project moving forward
• ISO 9001 ceertification awarded.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

• Excellent timeliness
• Weekly calls to measure progress
• Willing to take on additional responsibilities when we were slow
• Email responses were very prompt
• Very knowledgable 
• Ultimately we were able to receive our certification in record time.

What was your primary form of communication with Catalyic Security?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

• Willing to be part of the team instead of acting like an outsourced team
• They were knowledgeable about their domain.
• There is excellent chemistry between their team and our team.
• Pleasant team to deal with

Are there any areas for improvement or something Catalyic Security could have done differently?

We didn't find anything that was holding us back.  We have rehired them to get ISO27001 certification.

BACKGROUND

Introduce your business and what you do there.

I’m the CTO of an IT company. 

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Catalyic Security?

We needed help with our ISO certification.

SOLUTION

What was the scope of their involvement?

Catalyic Security handles our ISO certifications. They help us to achieve the milestones for defining our policies regarding ISO. They’re currently guiding us in migration.

What is the team composition?

There are 3–4 people assigned to our project.

How did you come to work with Catalyic Security?

They have a local office near us, and we found good reviews in the market about them. We decided to hire them for their consultancy service.

How much have you invested with them?

We've spent less than $10,000 with them.

What is the status of this engagement?

We started working together in December 2020, and the project is ongoing.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

I don’t have the metrics at the moment, but it's been a perfect partnership.

How did Catalyic Security perform from a project management standpoint?

Project management is good — we have regular communication through weekly Zoom meetings. Also, their timeline meetings are excellent; each milestone is met.

What did you find most impressive about them?

Their reputation in the local market is outstanding.

Are there any areas they could improve?

I don't think there's anything they can improve on — everything is good. 

Do you have any advice for potential customers?

I recommend working with them — they’re great at providing the direction to achieve your goals as soon as possible.

BACKGROUND

Please describe your company and position.

I am the Group Head IS of PARCO

Describe what your company does in a single sentence.

PARCO

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Catalyic Security to accomplish?

• ISO 27001:2022 Certification

SOLUTION

How did you find Catalyic Security?

Referral

Why did you select Catalyic Security over others?

• Pricing fit our budget
• Great culture fit
• Good value for cost

How many teammates from Catalyic Security were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

ISMS Transition for Certification    GAP Assessment with respect to all mandatory documents of ISO 27001:2022.Corrective actions and development of Policies and Procedures including SOA.Risk Assessment including Risk Treatment Plan.Internal Audit. ISO 27001:2022 Lead Implementor Training.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

ISMS Certification ISO 27001:2022

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Way better than and as per Project Plan. 

What was your primary form of communication with Catalyic Security?

In-Person Meeting

What did you find most impressive or unique about this company?

Their communication was impressive

Are there any areas for improvement or something Catalyic Security could have done differently?

Recommended

BACKGROUND

Please describe your company and position.

I am the Senior Manager Data Center Services of an art university.

Describe what your company does in a single sentence.

Libral Art University

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Catalyic Security to accomplish?

• ISO 27001:2013 Migration to ISO 27001:2022
• External Audit

SOLUTION

How did you find Catalyic Security?

They have been working with for a number of years

Why did you select Catalyic Security over others?

• High ratings
• Pricing fit our budget
• Good value for cost
• Company values aligned

How many teammates from Catalyic Security were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

Migration of ISO 27001:2013 to ISO27001:2022 with training and complete documentation update.

2nd surveillance and transition audit from Iso 27001:2013 to ISO 27001:2022 

The main purpose of this audit was to check the continual compliance against the requirements of ISO 27001:2022 (ISMS) Standard along with applicable legal Parameters.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

Successful Migration from ISO27001:2013 to ISO27001:2022

Surveillance and transition audit from ISO 27001:2013 to ISO 27001:2022 

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Most of the items have been delivered on time.

Catalyic Security's response was very prompt and satisfactory.

What was your primary form of communication with Catalyic Security?

• In-Person Meeting
• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

The entire team is thorough professional and well versed of thier respective domain

Are there any areas for improvement or something Catalyic Security could have done differently?

Organize community awareness programs to educate the public on safety practices and the role of security personnel

BACKGROUND

Please describe your company and position.

I am the Employee of Max Media Solutions

Describe what your company does in a single sentence.

Communication solution provider

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Catalyic Security to accomplish?

• Complete CS Audit as per NCA

SOLUTION

How did you find Catalyic Security?

Online Search

Why did you select Catalyic Security over others?

• High ratings
• Close to my geographic location
• Pricing fit our budget
• Great culture fit
• Good value for cost
• Company values aligned

How many teammates from Catalyic Security were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

Annual CS Audit for the year 2024

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

Despite short notice they sucessfully met the goals and completed the audit in record breaking time.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Their project management was very professional, with parallel task execution, leading to a fast turnaround without stressing.

What was your primary form of communication with Catalyic Security?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

Puntuality, work culture, ethics, professionalism, accuracy

Are there any areas for improvement or something Catalyic Security could have done differently?

I think they are doing well already but brining some Arabic language skills onboard will be a feather in their cap.

BACKGROUND

Please describe your company and position.

I am the CTO of a software development company.

Describe what your company does in a single sentence.

Our company is a software house that builds mobile and web application for the fintech industry

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Catalyic Security to accomplish?

Vulnerability and Penetration Testing

SOLUTION

How did you find Catalyic Security?

LinkedIn

Why did you select Catalyic Security over others?

• High ratings
• Pricing fit our budget
• Good value for cost

How many teammates from Catalyic Security were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

The scope of work for our is described below: 

• Pre-Assessment Phase: 
  • Project Kick-off: Define the objectives, goals, and scope of the VAPT engagement. 
  • Gathering Information: Collect information about the application, its architecture, technology stack, and potential threats. 
• Reconnaissance: 
  • Footprinting: Collect information about the application's external infrastructure and attack surface. 
  • Enumerating Attack Vectors: Identify potential entry points and attack vectors. 
  • Scanning: Vulnerability Scanning: Use automated tools to scan the application for known vulnerabilities such as SQL injection, cross-site scripting (XSS), and others. 
  • Port Scanning: Identify open ports and services running on the application's servers. 
  • Web Application Scanning: Perform automated scans of the web application for common vulnerabilities. 
• Manual Testing: 
  • Manual Code Review: Inspect the application's source code for security flaws. 
  • Authentication Testing: Assess the effectiveness of authentication mechanisms. 
  • Authorization Testing: Check for access control issues. 
  • Input Validation Testing: Test how the application handles various inputs to detect vulnerabilities like injection attacks. 
  • Business Logic Testing: Assess the application's logic for security vulnerabilities. 
  • Session Management Testing: Evaluate session handling and management. 
• Exploitation: Attempt to exploit discovered vulnerabilities to confirm their existence and severity. Simulate real-world attack scenarios to assess the impact of vulnerabilities. 
• Post-Exploitation: Assess the potential consequences of successful attacks. Determine the extent of data exposure or system compromise. 
• Reporting: Document all identified vulnerabilities, including their severity, potential impact, and steps to reproduce. Provide clear and actionable recommendations for remediation. Prioritize vulnerabilities based on risk. 
• Re-Testing: After the application's developers have addressed the identified vulnerabilities, conduct re-testing to confirm that the issues have been resolved. 
• Verification and Validation: Ensure that the recommended fixes do not introduce new vulnerabilities. Verify that the application's security posture has improved. 
• Final Reporting: Deliver a final report that includes details of the re-testing results and an overall assessment of the application's security. 
• Documentation: Maintain detailed documentation of all testing activities, including tools used, test cases, and findings.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

In our vulnerability and penetration testing project, success is measured by a significant reduction in critical vulnerabilities, with a decrease from 30 critical vulnerabilities to just 0, along with a 90% decrease in high-severity issues. The remediation rate was impressive, with 70% of critical vulnerabilities addressed within one week. 

The security posture improved substantially, resulting in a 75% reduction in the overall risk score. Testing coverage reached 90% of the application's components and functionalities, while false positives were minimized to only 2%. Overall, the project demonstrated a proactive approach to security, leading to substantial cost savings by preventing potential data breaches and enhancing application security.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

When evaluating Catalytic Security's project management, We found their performance to be commendable. They consistently delivered project milestones and outcomes on time, demonstrating a strong commitment to meeting deadlines. Their project management team exhibited excellent communication and responsiveness throughout the engagement. 

They were receptive to our needs, promptly addressing any concerns or questions that arose during the mobile and web application vulnerability and penetration testing project. This responsiveness played a crucial role in maintaining a smooth and efficient testing process. Overall, Catalytic Security's project management was effective, ensuring that the project progressed according to schedule and that our requirements were met in a timely and professional manner.

What was your primary form of communication with Catalyic Security?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

What we found most impressive and unique about Catalytic Security was their exceptional depth of expertise in mobile and web application vulnerability and penetration testing. Their team demonstrated a profound understanding of security threats and vulnerabilities, which was evident in their thorough testing approach and the ability to uncover even the most subtle security flaws.

Are there any areas for improvement or something Catalyic Security could have done differently?

We don't think so there is any recommendation from our side. They are technically sound and very professional in what they are doing.

BACKGROUND

Please describe your company and your position there.

I am the Chief Operating Officer of a digital strategy consulting company that designs and develops digital products and services.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Catalyic Security?

We were looking for an external trusted partner to execute penetration tests for multiple interconnected applications (web and mobile) who could execute the request efficiently

SOLUTION

How did you select this vendor and what were the deciding factors?

We talked to about five companies in different countries and after a few weeks of discussion we chose Catalyic based on their responsiveness, service package and expertise

Describe the project in detail and walk through the stages of the project.

They performed a full greybox test in all applications part of a bigger online ecosystem, exposing all vulnerabilities and quickly verifying/validating the patches

How many resources from the vendor's team worked with you, and what were their positions?

We had a project lead, and 3-4 experts in cybersecurity

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

The work was performed quick and according to time requirements, with excellent quality

How effective was the workflow between your team and theirs?

They kept us updated during the process and replied immediately to queries.

What did you find most impressive or unique about this company?

We appreciate that they delivered excellent results, with good price and within a short time span

Are there any areas for improvement or something they could have done differently?

No

BACKGROUND

Please describe your company and your position there.

I am currently working as CISO in MCB Islamic Bank Ltd and my role is to maintain bank security posture under the guidelines of regulator and security best practices.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Catalyic Security?

As part of regulatory mandate for annual application security assessment, Catalyic team were engaged.

SOLUTION

How did you select this vendor and what were the deciding factors?

We hire them as per technical evaluation of their existing team and industry references where they completed similar type of assignments.

Describe the project in detail and walk through the stages of the project.

Their team was very flexible and supporting during the project as we need to maintain the banking operation as well. There were two stages where the Cataylic team involved pre-testing and post testing after the recommended fixes applied.

How many resources from the vendor's team worked with you, and what were their positions?

There were three people involved, 1 is Project Manager and 2 testers.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Their experience in the relevant testing really help us to overcome the burden on bank information security team. The outcome resulting the balance between risk mitigation and acceptance.

How effective was the workflow between your team and theirs?

As I mentioned they were flexible and supportive at each and every stage of the project, they also understand the client requirement and sync with local team.

What did you find most impressive or unique about this company?

Catalyic Security's balance between cost and project objective was exceptional.

Are there any areas for improvement or something they could have done differently?

I wish they may include static and dynamic source code analysis services as well.