H-X Technologies

BACKGROUND

Please describe your company and your position there.

Astana International Exchange (AIX) https://aix.kz/ Information security officer

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire H-X Technologies?

independent assessment of our infrastructure

SOLUTION

How did you select this vendor and what were the deciding factors?

assessing the company's level of competence, feedback from partners, and how the company maintains its own security.

Describe the project in detail and walk through the stages of the project.

confidential

How many resources from the vendor's team worked with you, and what were their positions?

confidential

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

confidential

How effective was the workflow between your team and theirs?

5+ The team solved the tasks within the specified time frame.

What did you find most impressive or unique about this company?

high productivity, attention to detail, informative reports, help in solving problems

Are there any areas for improvement or something they could have done differently?

n/a

BACKGROUND

Introduce your business and what you do there.

I'm the COO of Theos.fi. We have three projects doing activities within the NFT space, such as minting, putting them in the marketplace, and pooling them. This allows fractionalization of NTFs and instant liquidity, solving the two main issues in the market. My role includes binding together the company's building blocks, including development, UI design, marketing, and commercial operations, to ensure a good outcome.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with H-X Technologies?

We hired them to do security audits of our code, including our app and smart contracts.

SOLUTION

What was the scope of their involvement?

H-X Technologies provides us with security audits and penetration testing. Using standard instruments and working offsite, they’ve tested our app and smart contracts to ensure our codes are working, bug-free, and without attack vectors. They did the test in three phases: first, they did manual tests looking into the code. Then, they looked at well-known bugs and well-known hacking attack vectors for us to proof against. The third test was automated testing. 

After testing, the team delivered a full report about all the different code snippets and lines they analyzed and their findings. They separated the report into groups of different severity levels and provided us with some suggestions on what to improve. Our specialists then fixed certain aspects that they found, correcting the code. Then, we had a routine check to see whether the issues had been fixed correctly, and the first part of the project was finished. 

They also provided some remarks about the quality of the code. The team published them on social media to inform our community that an external company had audited us, found nothing but low severity issues, and given us the green light. 

Currently, we’re about to launch the second version of our app with more functionality, and H-X Technologies is doing penetration testing for us. They’re trying to hack the system using certain tools to assess its vulnerabilities.

What is the team composition?

At the start, we worked with the engagement manager who onboarded us and met the CEO, who joined the first meeting to introduce himself. From there, we’ve worked with three engineers: a frontend specialist, a backend specialist, and a smart contract specialist. 

How did you come to work with H-X Technologies?

We found them through recommendations from our network. Auditing smart contracts is sophisticated work, so we needed a vendor who could provide a good experience for a fair price. H-X Technologies had a website and a good reputation, so we sent them an email. The team got back to us very quickly and was very friendly. 

After signing an NDA, we openly discussed what kind of code they’d need to analyze, giving them access to GitHub. After 1–2 days, they came back with an offer, estimated cost, and timeframe. The final choice came down to their offer and pricing. Additionally, H-X Technologies has Ukrainian roots, where whitehat hackers have a good reputation, and we also wanted to support Ukraine. Therefore, we signed the contract and gave them the go-ahead. 

How much have you invested with them?

We’ve spent $15,000. 

What is the status of this engagement?

We started working together in September 2021, and the engagement is ongoing.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement? 

The engagement with H-X Technologies has been very easy. Their security audit is based on certain methodologies, and they have clear procedures. They delivered a very easy-to-understand report with traffic light colors depending on the issues' severity. Furthermore, their explanations about what they tested and found are very detailed. 

How did H-X Technologies perform from a project management standpoint?

Their project management is good. We've set up communication channels and use Signal for secure instant messaging and meetings. Communication with them is straightforward, timely, and good. Whenever there's an issue or something they can't understand, they reach out to us, communicate openly with our developer, and get a good result. This has only happened once, though. When they gave us the report, they talked it through with us to clarify their findings and where we should put our focus. 

After we got acquainted, we had the estimate within two days and went into an iteration with the estimate. At first, the price was higher, and this was a misunderstanding because our developers told them to test more than what was needed. They were very open to checking the estimate once more and changing the offer. After that situation, nothing changed in our communication, and there were no bad feelings. 

What did you find most impressive about them?

We appreciate that we don't need to look for another service provider to provide penetration testing; we can stick with H-X Technologies and build up our partnership. We know their people and how they work, which gives us a time advantage and a knowledge advantage because we don't need to teach them from zero. Their services also help us be more secure and minimize the possibilities of risks. 

Additionally, I'm happy with getting to know the CEO, which shows that we're not just a number; they're really engaged when it comes to caring for their customers. I'm also satisfied with the communication, price, and results. 

Are there any areas they could improve?

There's nothing obvious that they need to improve; I'm very happy with them. That said, everyone can improve and should search for ways to do something better than before. 

Do you have any advice for potential customers?

Work with H-X Technologies! They're specialists in their field and work based on well-known and efficient methodologies in security testing. You can especially look to them if you're a blockchain company. Security is obscurity, and as a product owner, you need to pay attention to your security aspect because if you get hacked, your users will feel the impact. To get the most out of your engagement, ask questions if you don't understand something, want to know more about their methodologies, or know what is included in their service.

BACKGROUND

Introduce your business and what you do there.

I’m the operations director at a software company. Our main product is a project planning and collaboration application.

OPPORTUNITY / CHALLENGE

What challenges were you trying to address with H-X Technologies?

We wanted to become ISO certified.

SOLUTION

What was the scope of their involvement?

Initially, they provided application testing and network testing services. They’re currently acting as a consultant by helping us plan and implement the requirements for being ISO certified. 

What is the team composition?

I work with two people, including the CEO. 

How did you come to work with H-X Technologies?

I researched a lot of different companies and scheduled some interviews. We also reached out to our network to see if we knew anyone that had worked with the companies we were considering. H-X Technologies came highly recommended. 

How much have you invested in them?

We spent about €6,000–€8,00 (approximately $7,222–$9,630 USD). 

What is the status of this engagement?

We started working together in August 2020. The initial testing project was done by the end of September 2020. However, we currently have them on retainer.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

We’re happy with the work that they’ve provided. We turned over H-X Technologies’ reports to some of our customers, and they were impressed. Feedback has been positive. Our customers feel confident that our product is secure. 

How did H-X Technologies perform from a project management standpoint?

They do very well. They move quickly and deliver on time. We also have them work within our project management platform to keep things streamlined and organized. 

What did you find most impressive about them?

They’re efficient and show a sense of urgency. Even under tight deadlines, they don’t compromise the quality of their work. 

Are there any areas they could improve?

They could set up electronic signature capabilities for important documents. 

Do you have any advice for potential customers?

Have phone calls or Zoom calls with them. It’s better than email. 

BACKGROUND

Introduce your business and what you do there.

I’m the CTO of astarios. We’re specialized in nearshore IT services and originally worked in the area of software development. We expanded to cybersecurity as of 12–18 months ago. I'm responsible for the technical aspects of customer projects.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with H-X Technologies?

We had a customer in the med-tech field who’d created a couple of online contact services for the first time. The main focus of the project was doing a penetration test on those new services.

SOLUTION

What was the scope of their involvement?

We had two scopes of work: a white-box penetration test on the client’s new case registration form, and a gray-box text on their 3CX VoIP system. This is what H-X Technologies did for us on this project.

What is the team composition?

I worked directly with their CEO and the white-hat penetration tester in charge of the team.

How did you come to work with H-X Technologies?

I’d known their CEO for a couple of years, but this was the first project we did together. I picked H-X because I’d monitored their work and liked the results. They also had a good price point. I didn’t really bother comparing them to competitors.

How much have you invested with them?

The cost of their work was around €6,000 ($7,000 USD).

What is the status of this engagement?

The project ran between August–October 2020. We’re building on this initial success, and we plan to continue the collaboration with H-X.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

We originally planned one penetration test, but the customer was so happy with the results that they initiated the second one. H-X Tech’s timing and quality of deliverables were excellent. They delivered a huge report, which was impressive to our client.

How did H-X Technologies perform from a project management standpoint?

We communicated using Telegram, and they were very responsive. Any questions we had were answered within 15–30 minutes. We had a lot of questions and overall communication, and I can’t say anything bad on this front. The statement of work was 1–2 pages, and it was quite clear on what should be delivered so we didn’t need any project management tools. A penetration test takes 5–7 days, so it was a pretty short project. It wasn’t something that needed heavy management.

What did you find most impressive about them?

I come from Switzerland, which is a very expensive country. H-X stood out in terms of price relative to the impressive work they delivered. There is nothing negative to be said.

Are there any areas they could improve?

In the context of this engagement, I really have no advice for them.

Do you have any advice for future clients of theirs?

Thinking of the work I did with H-X, there’s really nothing to watch out for. It was all pretty straightforward and detailed, and we got reports at the end of the day. It exceeded my expectations.

BACKGROUND

Introduce your business and what you do there.

I’m a core product owner at a cybersecurity assessment software firm. We’ve been in the market for about 18 years. I’m responsible for all the analytics, networking, architectural solutions, and product security.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with H-X Technologies?

We had an internal and external obligation to perform the security assessment on our software and publish the public available report to outside. The vendor we used to work with for penetration testing didn’t match our criteria and we weren’t too happy with the results. I started to look for a replacement.

SOLUTION

What was the scope of their involvement?

We outlined the scope quite sharply. I gave them the exact amount of applications and the web pages they needed to test. We gave them all the required users with the privileges that they asked for. It was gray box testing. They knew partial information about our system and tested three web applications, the platforms, some internal components, and the REST API.

We are giving them some time for the security assessment. Then we’ll take the report and findings and fix everything. We have outlined timeframes to do this. Then we will install the environment for them to retest. After the retest, our partnership may be considered closed. Then we will start another one.

In our particular case, we weren’t purchasing a single service. We were purchasing a cyclic relationship to use twice a year. They started with the security assessment. They fixed everything and retested it. Everything goes in a time frame of half a year. Immediately, they start an additional cycle. In our case, we needed someone who knew the job.

What is the team composition?

I have direct contact with their CEO. He was and always is available for me. The day we started the assessments, the project manager stepped into the picture.

How did you come to work with H-X Technologies?

I did a Google search and picked out four different candidates, engaging in negotiations with each of them one-by-one. They did demos and sessions and we chose H-X Technologies. They matched our criteria for the clarity of the report, their availability, and the structure of their project management. I did some research and asked for some recommendation context from them. They gave me two information security managers from the other companies they performed similar services for. I talked to each one and it was okay. I gave them my requirements to be fulfilled and they agreed on it.

How much have you invested with them?

They are much cheaper than their competitors.

What is the status of this engagement?

We started working together in August 2019 and the work is ongoing.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

The impact on our organization is huge. I’ve chosen them because I found them to be a perfect combination of their professionalism, price, and simple negotiations.

How did H-X Technologies perform from a project management standpoint?

The project manager was supposed to put all the things together and connect between us, the customer, and their professional team. Everything is clear. They don’t miss any details. The project manager asked what platform was most preferable for me and I chose WhatsApp. She created a group and put all the testers, security guys, and the CEO in it. All the communication was through this channel. I didn’t ever need to ask for anything. Everything was smooth and transparent. She sent me the intermediate reports week by week. Every week, she sends me a draft so we could prepare for our part of the job from our end. We also use Zoom and email.

What did you find most impressive about them?

All of their professionals have a high degree from university. They’re not just taking three-month courses. All of them have huge experience in this industry. They step into negotiations easily and are confident with their knowledge. All these small things are actually bringing in customers.

Are there any areas they could improve?

I can’t think of anything. I feel comfortable with everything I got from them.

Do you have any advice for potential customers?

They’re extremely professional. The potential customer must outline exactly what their expectations and needs are.

BACKGROUND

Introduce your business and what you do there.

I’m an information security officer at a stock exchange company.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with H-X Technologies?

In our company, we follow strict policies. Before going live, we needed help doing security assessments, which included penetration testing as well as other information security tests.

SOLUTION

What was the scope of their involvement?

They did the security assessment testing. In short, they did gray box testing, which means they performed static analysis, dynamic testing, and static testing. That includes fuzzing testing and penetration tests. They also performed a partial code review as well.

What is the team composition?

There are people responsible for different tasks on the team. We had a project manager and we had other people who had different roles.

How did you come to work with H-X Technologies?

We conducted a procurement process, and H-X Technologies was the winner of the bid. Before distributing an RFP, we did a market analysis. We of course looked at the skills the company has. Security assessment is very highly dependent on skills, and we invited several companies. We chose H-X because we had a good reference from other companies and their team’s skills were among the best. Their price was reasonable, and their approach to security testing met our requirements.

How much have you invested in them?

We spent between $5,000–$10,000.

What is the status of this engagement?

We began working with them in January 2020, and it is ongoing as we haven’t finished yet.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

Since I am an information security officer, I understand the work they are doing. They would provide us with reports, and I checked the progress.

How did H-X Technologies perform from a project management standpoint?

They’re good. We had weekly calls, and everything was on time. We were behind by a week, but that was because we hadn’t prepared the environment on time, and wasn't from their side.

 If I had any concerns or we needed to make any changes in their methodology I would let them know. We didn’t have much to change, and they were very good and very quick to respond. They also provided us with recommendations as well which helped us save time.

What did you find most impressive about them?

Their skills are impressive and they have a very good team. For example, when comparing them to a local company here which only has one team member with a certain certification, on their team, each person has this certification. Their skills were very good, and they also have integrity.

Are there any areas they could improve?

They are located in a different country so we do have a time difference between us. If they had an office in our city, it would be excellent. There were times when we didn’t get a quick response but that was because they were sleeping when we were working.

Do you have any advice for potential customers?

If you have a clear statement of work, everything will go smoothly.

BACKGROUND

Please describe your company and your position there.

I’m managing director of Germany IT / product company AMERIA AG in Ukraine.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire H-X Technologies?

We develop a product Connected Experience and we had to get to another level of security and get automotive related ISO certificate called TISAX. Then we also orders back and grey box Pentest and still working on monthly fee to have permanent security officer from UA side.

What were your goals for this project?

We had to get a new level of official automotive certification TISAX

SOLUTION

How did you select this vendor?

The company did security training for us in the past. We decided to go with them. But we made analysis of couple of other companies also from Germany.

Describe the project in detail.

We’ve got a full time person for TISAX preparation and constant consulting from the company. We planned many activities by flying to Germany to HQ many times and got on to the level to make an exam.

What was the team composition?

We had one full time employee from the company, me - accountable and then doing the exam, German security officer and couple of background people helped from both sides.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

We are TISAX certified, also made pentests, improved security of our software

How effective was the workflow between your team and theirs?

All was fine, liked response time and permanent cooperation

What did you find most impressive about this company?

They know what they're doing; they are great consultants.

Are there any areas for improvement?

Can’t say so at the moment

BACKGROUND

Introduce your business and what you do there.

I’m an IT project manager for FluentPro. Our main office is located in Redmond, Washington, but we have a customer care team in Ukraine as well as a development team and other resources.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with H-X Technologies?

We have cloud-based applications and provide cloud services for project and portfolio management to customers working with Microsoft Project. One of our goals was to find a third-party enterprise that could do a penetration testing audit for us. Our cloud service provider is G Suite, and we identified H-X Technologies as an external provider for a security audit and penetration test for our service.

SOLUTION

What was the scope of their involvement?

H-X Technologies conducted a security audit of our cloud infrastructure. This included an analysis of the kinds of security gaps we had on our cloud service and an external penetration testing of our application. Specifically, it was gray-box penetration testing. We provided them access to our cloud platform but without any login credentials or other details. We wanted to see how hackers from the outside world could enter our system.

I believe they tested the application for one month and provided us with a penetration test report with recommendations on what we should improve in our company and solutions. After some research and after following their recommendations, we mitigated the high-risk exposures and relaunched the website. They performed another brute-force and penetration test after we took those mitigation measures, and worked according to OWASP 10.

How did you come to work with H-X Technologies?

I assessed different providers in Ukraine and H-X Technologies had very good reviews from other companies. They also had a great price and quality according to those reviews. We had a call with them, and they satisfied our requirements for the basic security tests we needed.

How much have you invested with them?

We invested $4,000 on this project.

What is the status of this engagement?

The collaboration lasted for three months and ended six months ago, around April 2019. There was a pre-security assessment, the testing itself, and a retesting after following their recommendations.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

H-X Technologies was contracted for three months to look for various kinds of vulnerabilities, according to OWASP 10. In terms of success, they found vulnerabilities that were critical for our project. Every security company has its own approach for security testing, and we couldn’t know what kind of vulnerabilities H-X Technologies would find, so we didn’t track exact metrics.

How did H-X Technologies perform from a project management standpoint?

Project management was handled well. They sent us project status reports once a week and we always got effective communication from their side. They also sent us two kinds of reports that were agreed upon in the contract.

What did you find most impressive about them?

H-X Technologies has proper security practices. We checked a lot of things following the security assessment on our side as well and found the same vulnerabilities. Overall, H-X Technologies did an extensive assessment. They also provided an internal report for our company, along with a report we could show customers without confidential information around our vulnerabilities.

Are there any areas they could improve?

I haven’t dealt with other security companies, so I don’t have a something to H-X Technologies with. We had a really good experience.

Do you have any advice for future clients of theirs?

I’d definitely recommend them to others, and we plan to use some of their services in the future for an ISO 27001 certification and other security audits.

BACKGROUND

Please describe your company and your position there.

Skybox Security is the only platform that collectively visualizes and analyzes hybrid and multi-cloud networks, providing full context and understanding of the attack surface. Skybox Security provides the most powerful risk analytics for cybersecurity, giving security management and operations tools they need to eliminate attack vectors and safeguard business data and services.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire H-X Technologies?

We are working for several years with H-X Technologies, and we did our annual security audit on several assets.

SOLUTION

How did you select this vendor and what were the deciding factors?

We are working for several years with H-X Technologies

Describe the project in detail and walk through the stages of the project.

Performing a security audit and scans of our assets to identify any potential risks. working with several tools, and performed a vulnerability analysis according to OWASP

How many resources from the vendor's team worked with you, and what were their positions?

We had three team members and a project manager.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

The team did a high-quality job

How effective was the workflow between your team and theirs?

all of the steps were done with full coordination with our team, and we have a good communication channel.

What did you find most impressive or unique about this company?

Very professional with high quality service.

Are there any areas for improvement or something they could have done differently?

No.

BACKGROUND

Please describe your company and your position there.

I am in charge of software engineering for MEF.DEV digital transformation platform

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire H-X Technologies?

To meet the latest cybersecurity standards and requirements, we at NATEC decided to invite a team of professionals to run a grey-box cybersecurity penetration test on our systems.

SOLUTION

How did you select this vendor and what were the deciding factors?

We looked for cybersecurity professionals in the Telecom domain and the H-X team was the best fit since it has the OSCP and CISSP certified professionals

Describe the project in detail and walk through the stages of the project.

The H-X team used best practices, including Open-Source Security Testing Methodology Manual, Open Web Application Security Project, NIST, and ISACA to identify weaknesses, risks, and possible threats.

How many resources from the vendor's team worked with you, and what were their positions?

several OSCP and CISSP certified professionals

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

As a result, several vulnerabilities were diagnosed, mitigated, and eliminated. The repeated pentest confirmed that the MEF.DEV platform had gained a sufficient level of security for public use

How effective was the workflow between your team and theirs?

They guided us E2E through the whole OWASP audit and consulted us on each step

What did you find most impressive or unique about this company?

They are customer-centric and well experienced in cybersecurity.

Are there any areas for improvement or something they could have done differently?

To automate the audit result delivery process