phew

BACKGROUND

Introduce your business and what you do there.

I’m the director of Tessellate, an online platform to securely collect, process, and categorise data uploads.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with phew?

We required an independent penetration test of our platform to confirm it was production-ready for enterprise and government clients.

SOLUTION

What was the scope of their involvement?

phew undertook independent commercial penetration testing using a grey-box methodology of the Tessellate application and API, with reference to OWASP Top-10 and CWE/SANS Top-25 vulnerability categories. Deliverables included a detailed testing report, covering methodology and recommendations, and an assurance report for public consumption. Phew provided detailed guidance and recommendations and retesting after fixes were in place to confirm issues were addressed.

What is the team composition?

We worked with 2–5 teammates from phew.

How did you come to work with phew?

We found them through an online search and a government-approved security provider list. We chose them over other options because their pricing fit our budget, they had a great culture fit, they offered good value for money, and a high degree of rigor following industry standards and best practices.

What is the status of this engagement?

We worked together from August–September 2026.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

phew provided communication while the penetration testing was underway, including clarifying information and collaborating to refine the severity of identified vulnerabilities. After identifying some lower-severity issues and recommendations, they confirmed the applications production-readiness through delivery of a detailed pen-test report and assurance report. We’ve proceeded to close a sale with a client in part because we could provide independent verification of our application's security.

How did phew perform from a project management standpoint?

They had great project management and communication. We primarily communicated via email and phone after an initial video conference.

What did you find most impressive about them?

They were easy to work with, flexible around our requirements and timelines, and very professional. I appreciated their in-depth understanding of security standards beyond the other companies we talked to.

Are there any areas they could improve?

No, they were great.

BACKGROUND

Please describe your company and position.

 I am the VP of Engineering of an information technology company 

Describe what your company does in a single sentence.

We're a cloud-based property management platform purpose-built for commercial real estate, giving property managers, landlords and investors a single system for lease administration, accounting, maintenance and portfolio reporting.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire phew to accomplish?

• Ongoing penetration testing of our web applications, mobile applications and APIs
• Independent validation of remediation — re-testing to confirm fixes are effective, and certification we can present at annual audit and in customer security reviews
• Assurance for customers and partners that our platform is independently tested on a regular schedule

SOLUTION

How did you find phew?

Referral

Why did you select phew over others?

• High ratings
• Close to my geographic location
• Pricing fit our budget
• Great culture fit
• Good value for cost

How many teammates from phew were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

Phew run our penetration testing programme on a continuous cycle rather than as one-off engagements. 

Scope. Our core applications are tested every round. The remainder of our internet-facing estate rotates through the schedule so that everything is assessed on a frequent known cycle, which lets us extend coverage as we add applications without testing everything every time. Scope for each round is agreed in advance, with credentials, environments and prerequisites confirmed before testing begins. 

Approach. Testing is conducted against our staging environments with source code access and application credentials. The code access is deliberate on our part, it means that when a vulnerability is identified, their testers can determine whether the same pattern recurs elsewhere in the codebase rather than reporting a single instance. That has consistently given us more value than black-box testing would. 

Key deliverables per round:

• A detailed report of findings, each rated by severity with supporting evidence and remediation guidance
• Findings structured so they translate directly into engineering work items assigned to the owning squad
• A re-test after remediation to independently confirm each issue is resolved
• A certificate of assurance on successful validation, which we use in our annual security audit, in customer security questionnaires, and as public evidence of our security posture
• Comparison against the previous round, so we can see whether the overall trend is improving 

Ongoing engagement. Alongside the testing itself, Phew maintain a shared Slack channel with our engineering team for questions during a round, and have provided indicative scoping and pricing advice as our application portfolio has grown, including confirming that pricing flexes down if we reduce targets, not just up if we add them.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

With the aim of improving the overall security of the product suite, providing ongoing assurance our company and its stakeholders and partners

The programme delivers on schedule and produces work we can act on immediately. Every round has been completed within the agreed window, and findings arrive structured well enough that they convert straight into prioritised engineering work items on the owning squad's backlog, each with a remediation timeframe tied to its severity. We track closure of those items against those timeframes.

The clearest measure of success is independent verification: after remediation, Phew re-test and confirm resolution, and issue a certificate of assurance. That certificate is the outcome we use in our annual security audit and in customer security reviews, and it's evidence that issues raised have actually been closed rather than just logged.

Beyond individual rounds, the programme has changed how we build. Patterns identified in one round feed into what our engineers watch for in the next, and testing with source code access means a single finding gets traced across the codebase rather than fixed in one place, so remediation is broader than the finding itself.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Scheduling is the strongest part of it. Rounds are booked well in advance against a fixed cadence, scope is agreed before testing starts, and prerequisites — environments, credentials, target confirmation — are worked through up front rather than surfacing mid-round. Reports have arrived when they said they would, every round. The re-test is scheduled around our remediation timeframes rather than theirs, which matters because it means the verification lands when we're actually ready for it rather than forcing us to rush fixes to meet a testing slot.

Day to day, we run a shared Slack channel between our engineering team and theirs. That's the thing that makes the engagement work. Our engineers can put a question directly to the people who found the issue and get an answer in hours, rather than raising a ticket and waiting for a formal response. We have a consistent named contact across rounds, so there's no re-explaining our environment or our estate each time.

On responsiveness to changing needs: our application portfolio has grown considerably over the course of the relationship, and Phew have adapted the programme with it. When we needed to understand the cost implications of extending coverage, they provided indicative pricing to help us make the decision internally. They've been transparent about their own pricing changes rather than presenting them as a fait accompli. That flexibility on both direction is not something we take for granted in a security vendor.

What was your primary form of communication with phew?

Email or Messaging App

What did you find most impressive or unique about this company?

They behave like an extension of our engineering team rather than an external auditor, and the difference shows up in the quality of what we get back.

Most security testing relationships are transactional, scope goes in, a report comes out, and the tester has no interest in whether you understood it. Phew work the other way. We give them source code and staging credentials, they give our engineers direct access to their testers through a shared channel, and the result is that a finding gets traced to root cause and checked for recurrence across the codebase rather than reported as a single instance and closed. Our engineers learn something from each round, which is not a thing I expected to be able to say about penetration testing.

The other thing worth noting is longevity. We've worked with them for over five years across a product estate that has grown substantially in that time. They understand our architecture, our environments and how we build, so each round starts from context rather than from scratch. For a specialist New Zealand consultancy, they've scaled with us without the relationship losing that closeness.

Are there any areas for improvement or something phew could have done differently?

Nothing significant. The one thing I'd note is a consequence of growth rather than a shortcoming on their part: as our application estate has expanded, the scoping conversation each cycle has become more involved. A consolidated view of findings and trends across rounds, rather than each report standing on its own, would provide value from a trend analysis and would make the internal conversation about coverage easier. That's a refinement to an already strong service, not a gap.

BACKGROUND

Introduce your business and what you do there.

I’m the co-founder of Reallo Limited, a fintech company that uses open banking to automatically redirect people's everyday underspending into savings and investments.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with phew?

We hired phew to run an independent penetration test of our platform before launch. We had three specific objectives: identify and validate security vulnerabilities across our web application and API since we handle sensitive financial data and live bank connections through open banking; remediate every finding and have phew verify the fixes through retesting rather than self-attesting; and obtain an independent security assurance report, which is a required step in our accreditation process with our open banking provider.

SOLUTION

What was the scope of their involvement?

phew carried out a full penetration test of our platform against our staging environment, covering both the web application and the API. The work ran end to end: an initial assessment that produced a structured findings report, then remediation support, then retest rounds to independently verify each fix.

What is the team composition?

We worked with 2–5 teammates from phew.

How did you come to work with phew?

We found phew through an online search. We chose them over other options because they had high ratings, their pricing fit our budget, and they offered good value for the cost.

How much have you invested with them?

We spent less than $10,000.

What is the status of this engagement?

We worked together in June 2026.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

phew identified nine findings, and we 100% remediated and independently retested them as fixed, with zero issues left open. The engagement produced a verified clean security posture and the assurance report that unblocked our open banking accreditation. From a scope and quality standpoint, the report covered everything required for the security assurance step. It documented the full assessment, the remediation of all nine findings, and phew's independent verification of the fixes, which was exactly the form of third-party validation our open banking accreditation called for. The report was thorough and clearly structured and gave us confidence it would stand up to external scrutiny.

How did phew perform from a project management standpoint?

phew's project management was excellent. Communication was clear and responsive throughout, and the findings report was well-structured and prioritized by severity, which made remediation easy to plan rather than wade through an unsorted list. They delivered on time and were genuinely flexible when it counted — when we were ready for retesting, they fit us in the very next day after we requested it, which kept our moment going and meant we weren't left waiting to verify fixes. For a small team like ours, that responsiveness and low-overhead organization was exactly what we needed.

What did you find most impressive about them?

phew understood the realities of a small pre-launch fintech — rigorous on security but realistic on budget and timelines, and they never treated us like a minor account. The responsiveness stood out: they fit us in for retesting the next day and verified every fix themselves rather than leaving it to us. That loop-closing rigor was exactly what we wanted from a security partner handling financial data.

Are there any areas they could improve?

On one of the smaller findings, slightly clearer guidance from the start on exactly what the fix needed to satisfy would have let us resolve it correctly in a single pass rather than doing extra work to be sure. It was a minor point on an otherwise very well-run engagement, and their fast responsiveness meant any back-and-forth was sorted quickly.