Secario Labs

BACKGROUND

Please describe your company and position.

I am the CTO of Trubrics

Describe what your company does in a single sentence.

Product analytics for LLM powered apps.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Secario Labs to accomplish?

• Pentest

SOLUTION

How did you find Secario Labs?

Referral

Why did you select Secario Labs over others?

Referred to me

How many teammates from Secario Labs were assigned to this project?

1 Employee

Describe the scope of work in detail. Please include a summary of key deliverables.

Trubrics has engaged Secario Labs (Secario) to perform a white-box security assessment of its platform and promotional website. The primary objective is to evaluate the security posture of these assets and provide actionable recommendations to address any identified design flaws. Trubrics has expressed concerns about threats such as service disruption, unauthorised access to sensitive data, and actions by threat actors that could harm the company’s reputation. Secario has also recommended focusing on risks related to attackers targeting backend services or cloud assets and leveraging Trubrics’ cloud environment as a pivot for targeting third parties. The assessment will prioritise external infrastructure, session management, input validation, and vulnerabilities in backend and cloud resources.

The assessment will be conducted in a non-production (UAT) environment, which will be Internet-exposed and not accessed by existing clients. Secario will request a change freeze to prevent modifications to the environment during the engagement, except in cases of critical risk requiring immediate attention. The process will involve both active testing of the platform’s functionality and a passive review of the application's source code, infrastructure-as-code configurations, and other relevant components to identify vulnerabilities. Following the delivery of the final report, Secario will be available for a debrief meeting to provide further context on the findings, including their risk and impact. Additionally, Secario will offer support to resolve challenges in understanding or implementing remediations and will conduct retesting if required.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

Secario Labs (Secario) was engaged by Trubrics Limited (Trubrics) to conduct a security assessment of its platform and promotional website. Trubrics’ SaaS platform enables businesses to monitor user interactions with AI systems, providing valuable insights to refine products and strategies. The assessment, conducted between 2 December 2024 and 9 January 2025, aimed to evaluate the platform’s security posture, identify areas for potential improvement, and provide recommendations to enhance overall resilience. The evaluation covered platform functionality, backend services, and overall security architecture. Secario’s approach aligns with widely recognised industry standards, including frameworks from OWASP, MITRE, CERT, and NIST. While the assessment sought to identify security risks within the agreed scope, it is important to recognise that security reviews provide a snapshot of the platform’s security at a given point in time. Findings are based on known vulnerabilities and attack techniques observed in the wild at the time of testing; however, new threats may emerge as the security landscape evolves. The assessment identified a small number of areas where security enhancements could further reinforce the platform’s defences, though no immediate risks were found. Trubrics has already taken proactive steps to address these areas, implementing improvements to authentication mechanisms, access controls, and backend security measures. Beyond these refinements, Secario observed that Trubrics maintains a strong security foundation. The platform incorporates robust access controls, comprehensive input validation, and protections against attacks, demonstrating a security-conscious approach to system design. As the platform continues to evolve, Secario recommends that Trubrics conduct regular security reviews to ensure new features and architectural changes do not introduce additional risks. This proactive approach will help maintain a strong security posture, ensuring the platform remains resilient against emerging threats while continuing to support its users securely and effectively.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Their project management was great, and they were very available throughout.

What was your primary form of communication with Secario Labs?

Virtual Meeting

What did you find most impressive or unique about this company?

The personal experience, taking the time to deep dive on issues with us and helping to find solutions.

Are there any areas for improvement or something Secario Labs could have done differently?

No

BACKGROUND

Introduce your business and what you do there.

I’m an executive at a cybersecurity research firm.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Secario Labs?

I needed help providing penetration testing for our clients.

SOLUTION

What was the scope of their involvement?

Secario Labs is our subcontracted partner and provides penetration testing for our clients. We provide them with technical documentation of cloud platforms and credentials to those platforms, such as Facebook accounts.

From there, they do penetration testing, basically trying to hack our clients, and then they present a report detailing the vulnerabilities they find.

What is the team composition?

We work with Phil (Managing Director) on the sales side and someone on the technical side. 

How did you come to work with Secario Labs?

We found Secario Labs through Upwork and decided they were a good fit because they gave the best answers to our technical questions from all the providers we interviewed.

How much have you invested with them?

So far, we’ve spent $2,000–$3,000.

What is the status of this engagement?

We started working together in January 2022, and the engagement is ongoing.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement? 

Secario Labs has found critical vulnerabilities for our clients, which helps them be more secure.

How did Secario Labs perform from a project management standpoint?

They’re very good at project management. I communicate directly with Phil through emails and meetings, and he’s very good; I have no complaints.

What did you find most impressive about them?

Secario Labs’ good communication distinguishes them from the competition. It’s hard to find a provider with good skills and good communication; we often get one or the other, and with Secarion Labs, we get both.

Are there any areas they could improve?

They could have more availability; they’re often too booked.

BACKGROUND

Please describe your company and your position there.

I am the co-owner and operator at a software dev company.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Secario Labs?

We hired Secario Labs to do penetration testing and application security assessment of our online platform.

SOLUTION

How did you select this vendor and what were the deciding factors?

We like to create personal connections with the vendors we work for so I was targeting for a smaller company.

Describe the project in detail and walk through the stages of the project.

Secario Labs guys were very supportive from the beginning till the end of the project, guiding us with requirements every step of the way.

How many resources from the vendor's team worked with you, and what were their positions?

Marketing, Engineering

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

They were able to identify potential risks that we were not aware of and we are now implementing all the recommended fixes.

How effective was the workflow between your team and theirs?

They kept us updated every step of the process. Very good communication.

What did you find most impressive or unique about this company?

They understood the underlying technologies well and had a very detailed look over the provided codebase.

Are there any areas for improvement or something they could have done differently?

Not that I can think of.

BACKGROUND

Please describe your company and your position there.

I am the Project Lead for Utilita Energy. Utilita Energy is an electricity and gas supplier operating in the United Kingdom. Utilita began trading in 2003 – specialising in Smart Pay As You Go Energy. It is one of the UK's largest energy suppliers by market share

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Secario Labs?

Secario Labs provided Penetration and Web Security testing for small enterprise web development application.

SOLUTION

How did you select this vendor and what were the deciding factors?

Price / Quality being value for money taking into account excellent level of service. They delivered quality reporting and documentation.

Describe the project in detail and walk through the stages of the project.

Web based product the could be accessed through clients Single Sign On and public website interface. Testing need to identify any weakness and vulnerabilities so these could be corrected in the development phase prior to going live.

How many resources from the vendor's team worked with you, and what were their positions?

2 project managers 1 Developer and 1 Penetration Security technician

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

They were able to identify any risks and the developer was able to work through them and make corrective actions detailed in their report and further testing was completed to check developer had address any risk identify in the report.

How effective was the workflow between your team and theirs?

Communication was excellent the right level of Secario Lab identifying Corrective actions that need attention, and communicated them in real time to the developer and not waiting for the completed report.

What did you find most impressive or unique about this company?

VFM and Quality off Communication managing expectations sort out critical process issues and helping with influence decision makers making a positive difference to achieve a sustainable outcome.

Are there any areas for improvement or something they could have done differently?

Recommendation to maintaining price and quantity overtime.

BACKGROUND

Please describe your company and your position there.

HQ SEO LTD is a UK based online marketing agency that provides primarily SEO and link building services to medium and large businesses across the globe. My position is founder/managing director.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Secario Labs?

We were looking to test how vulnerable our primary assets were (personal websites, client sites, client apps etc) after a hack on a wordpress lead generation site we own.

SOLUTION

How did you select this vendor and what were the deciding factors?

I was recommended via a business associate who used their company in the past and was happy with the service. Price was also competitive based on the other 2 quotes we had in.

Describe the project in detail and walk through the stages of the project.

They identified the risks of the sites and apps using a mix of penetration testing and softwares to scan vulnerabilities. Personally I'm not sure of the exact strategies that were used as it's slightly above my head but one of the good things was the clear communication and good reports that came from this (knowing that I wasn't tech savvy in the space), it wasn't just a list of code and numbers, it was actually useful to someone who didn't understand the tech behind it.

How many resources from the vendor's team worked with you, and what were their positions?

Our point of contact was the project manager, I believe there was also a primary penetration tester, aside from this I'm not sure.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

In the reporting they were able to find multiple issues with the sites and apps. Some fairly dangerous and other "smaller risks" that still could easily be fixed and hence should be updated to ensure we don't experience another cyber security issue.

How effective was the workflow between your team and theirs?

Pretty strong. Most communication was through email/slack.

What did you find most impressive or unique about this company?

Speed of communication and quality of clear reporting were two things that stood out.

Are there any areas for improvement or something they could have done differently?

Potentially before the project began, more emphasis could have been placed on explaining what happens in a non-technical way. Although the reporting did this well, the pre-project phrase was fairly technical.

BACKGROUND

Please describe your company and your position there.

I am the owner of a cybersecurity company providing Security Assessment services for Applications and Networks.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Secario Labs?

We worked with Secario Labs for Infrastructure Security Testing related project.

SOLUTION

How did you select Secario Labs and what were the deciding factors?

We have prescreened Hristo from Secario Labs during a job opening at SoCyber for Security Testers. Hristo holds leading industry certifications and has experience with international companies, which was a leading factor for us.

Describe the project in detail and walk through the stages of the project.

The project started with identification of the scope for the customer, after the initial Threat Modeling. Following the Information Gathering and Scanning phase we have successfully identified a number of vulnerabilities, which were exploited during the Exploitation Phase. The scan completed with report, outlining the activities, carried out.

How many resources from the Secario Labs team worked with you, and what were their positions?

1 person - Cybersecurity Expert

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

During the project few High and Critical vulnerabilities have been identified with the help of Hristo, which could potentially lead to exploitation of critical environment and leakage of confidential data.

How effective was the workflow between your team and theirs?

We have been communication on a daily basis, during the whole project duration.

What did you find most impressive or unique about this company?

Their unique approach and professionalism when it comes to communication with the customers were impressive.

Are there any areas for improvement or something they could have done differently?

No

BACKGROUND

Please describe your company and your position there.

Software development.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire Secario Labs?

Finding and eleminating security issues.

SOLUTION

How did you selectSecario Labs and what were the deciding factors?

I found their service from google.

Describe the project in detail and walk through the stages of the project.

They found and fixed the issue.

How many resources from the Secario Labs team worked with you, and what were their positions?

.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Secario Labs were not only able to identify security vulnerabilities which other vendors have somehow missed, but they went above and beyond to help us remediate them and verify the patches. The whole process from scoping, the carrying out of the assessment, the delivered report, to the final debrief were surprisingly well carried out.

How effective was the workflow between your team and theirs?

Perfect 10/10. Easy and fast communication.

What did you find most impressive or unique about this company?

The most impressive thing about Secario labs was their brilliant and troubleless workflow.

Are there any areas for improvement or something they could have done differently?

N/A