CYBRI

BACKGROUND

I am the Software Engineer of Ataraxis AI

Ataraxis AI builds AI-powered diagnostic tests that help oncologists personalize breast cancer treatment decisions using routine pathology slides.

OPPORTUNITY / CHALLENGE

• Performed a web application penetration test, cloud configuration review, as well remediation tests.

SOLUTION

Online Search

Good value for cost

2-5 Employees

Cybri ran two white-box penetration tests in parallel: one on our clinical web application and APIs, and one on the Google Cloud Platform infrastructure behind it. We work with patient data, so we needed independent validation for HIPAA compliance and customer security reviews. The web application test covered authentication and SSO, authorization and tenant isolation, session management, input validation, business logic, and API security, aligned with OWASP WSTG, ASVS, and the Top 10. The GCP test covered IAM and service account privileges, credential and key management, Cloud SQL exposure and encryption, Cloud Storage access, Cloud Run authentication, firewall rules, secrets handling, and organization policy guardrails, aligned with the CIS GCP Benchmark. Key deliverables: Detailed reports for both tests, with severity and risk ratings, evidence, and specific remediation steps for each finding Clear explanations of how individual findings combined into larger attack paths, plus credit for controls that held up A retest of the web application after remediation, which confirmed fixes and lowered our risk rating from High to Medium Documentation we use for compliance and customer security questionnaires

RESULTS & FEEDBACK

• Web application risk rating dropped from High to Medium after remediation and retest.
• The app test found 18 issues, including 1 Critical and 1 High. After the retest, 13 were closed, including every Critical and High, leaving 3 Medium and 2 Low.
• The GCP test found 10 infrastructure issues (4 High, 4 Medium, 2 Informational), each with specific remediation steps that turned into our hardening plan.
• Both tests, remediation, and the app retest were completed in under a month, from July 24 to August 20, 2026.
• The reports now serve as evidence for HIPAA compliance and customer security questionnaires.

Cybri ran a well-structured engagement and stuck to the timeline they set at kickoff. The plan was two days of preparation (kickoff, document transfer, connection testing), one week of testing, then reporting. Both reports arrived on schedule. When we finished remediating the web application findings, they scheduled the retest promptly and completed it within about a week. They adapted well to our setup. They worked within the read-only test identities we provisioned, kept testing non-disruptive, and stayed out of systems that were out of scope. Their reports were written for two audiences: technical detail our engineers could act on directly, and business-impact summaries that leadership and compliance stakeholders could follow. When we had questions about specific findings, they were responsive and clarified expected fixes. Some items needed a round or two of back-and-forth before we were aligned on the right remediation.

Email or Messaging App

What stood out was the quality of Cybri’s analysis, not just the list of findings. Instead of handing us scanner output, they traced how separate issues combined into real attack paths. For example, they showed how an over-privileged service identity, a publicly reachable service, and database access settings compounded each other. That made prioritization straightforward. They were also unusually honest about what they could and couldn’t prove. When an attack path was blocked, they said so, credited the control that stopped it, and explained why the underlying misconfiguration still needed fixing. They never inflated severity. They clearly separated confirmed exposure from demonstrated breach, which matters when we present results to customers and auditors. Their remediation guidance was practical and sequenced. It noted which fixes had to come first to avoid breaking other remediation steps, and which preventive guardrails would keep fixes from regressing. They also understood the sensitivity of a clinical data environment and handled credentials carefully throughout, for example reporting secret lengths rather than reproducing the values.

The core findings were excellent, but parts of each report were boilerplate, such as a long generic acronym list and template wording. A shorter executive version alongside the full report would help when sharing with customers.

BACKGROUND

Introduce your business and what you do there.

I’m the CEO of Click Contracts, a business services company. We provide an easy-to-use contract writing app for real estate agents, enabling fast creation, electronic signing, and management of real estate agreements. We also offer reporting tools for team performance and sales forecasting.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with CYBRI?

We needed help with penetration and vulnerability testing.

SOLUTION

What was the scope of their involvement?

CYBRI has provided thorough penetration and vulnerability testing for our entire app. The team has delivered a detailed report and walkthrough via Zoom, prioritizing urgency and levels of severity. The team has gone through every item in the report in a detailed manner.

What is the team composition?

We’ve worked with 2–5 teammates from CYBRI.

How did you come to work with CYBRI?

We found them through an online search. We chose them over other options because they had high ratings.

How much have you invested with them?

We’ve spent around $10,000–$50,000.

What is the status of this engagement?

We started working together in January 2026, and the engagement is ongoing.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

CYBRI has provided a clear plan of action, and we expect to see a significant reduction in vulnerabilities after the retesting. We’re currently working on the issues, thanks to the clarity CYBRI has given us.

How did CYBRI perform from a project management standpoint?

CYBRI delivers on time and has unmatched expertise. We communicate via virtual meetings, emails, and messaging apps.

What did you find most impressive about them?

CYBRI’s ability to take the most complex security vulnerabilities and explain them to all stakeholders, from the non-technical to the highly technical, is impressive. The team is also patient in ensuring everyone understands exactly how to remedy the issues.

Are there any areas they could improve?

I don’t think there’s anything they can improve on — they’re amazing.

BACKGROUND

I am the GTM & Strategy of Ataraxis AI

AI-based clinical oncology diagnostics 

OPPORTUNITY / CHALLENGE

• Performed a web application penetration testing, cloud configuration review, and remediation testing.
• SOC 2 compliance
• Client request

SOLUTION

Online Search

• Pricing fit our budget
• Good value for cost

2-5 Employees

Authenticated Web Application Penetration Testing, GCP Infrastructure Penetration Testing, and a Remediation Test to confirm remediations. 

RESULTS & FEEDBACK

We were able to get the critical, high, and the majority of medium-level vulnerabilies remediated. 

The team was extremely responsive to our requests and delivered all asks on time. 

• Virtual Meeting
• Email or Messaging App

The high level of responsiveness even after periods of no communication

N/A

BACKGROUND

Introduce your business and what you do there.

I'm an executive of Crucible International Inc. We provide cost-effective back office outsourcing solutions for the healthcare, financial services, insurance, and legal sectors, operating from our processing center in Bridgetown, Barbados.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire CYBRI to accomplish for Crucible International Inc.?

We hired CYBRI for a penetration test for one of our clients to ensure that there were no threats to our network.

SOLUTION

Describe the scope of work provided by CYBRI.

CYBRI provided a penetration test and delivered a report.

What is the team composition?

We worked with 2–5 teammates from CYBRI.

How did you come to work with CYBRI?

We found them through an online search, and their pricing fit our budget.

What is the status of this engagement?

We worked together from June 2020 to August 2024.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

We were able to satisfy the client with the results of the test. The feedback regarding the remediation of potential threats allowed us to update our firewalls.

How did CYBRI perform from a project management standpoint?

They delivered on time. Our primary forms of communication were virtual meetings, emails, and messaging apps.

What did you find most impressive about them?

We were impressed with their approach to the project, timeliness, and delivery.

Are there any areas they could improve?

There's nothing they need to improve.