SoCyber

BACKGROUND

Please describe your company and position.

I am the CTO of Videoengager, Inc.

Describe what your company does in a single sentence.

Provides video chat services

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire SoCyber to accomplish?

• Web Application and API Penetration testing

SOLUTION

How did you find SoCyber?

Referral

Why did you select SoCyber over others?

• High ratings
• Close to my geographic location
• Pricing fit our budget
• Great culture fit
• Good value for cost
• Referred to me
• Company values aligned

How many teammates from SoCyber were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

SoCyber aimed to evaluate the security posture of VideoEngager’s Web Application and API compared to current industry best practices. All testing performed was based on the OWASP Web Security Testing Guide and other customized frameworks.

Key deliverable is Penetration Testing Report 

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

Project outcome is Reduced CVSS Risk Scores by addressing high and medium severity risks in our system.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

The SoCyber team demonstrated efficient project management with streamlined communication and contract processes, including prompt NDA signing. Their technical team is highly professional, consistently delivering work on time and within budget while being responsive to the project's needs.

What was your primary form of communication with SoCyber?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

The most impressive aspect of this company is their streamlined communication and contract processes, ensuring swift project initiation. Additionally, their highly professional technical team consistently delivered quality work on time and within budget, showcasing exceptional reliability and efficiency.

Are there any areas for improvement or something SoCyber could have done differently?

Post-Remediation Verification:
Including a proposed follow-up or verification phase after fixes have been implemented would help ensure that vulnerabilities are fully addressed and that no regressions occur.

BACKGROUND

Please describe your company and position.

I am the CTO & Co-Founder of Generic Soft Ltd.

Describe what your company does in a single sentence.

Generic Soft specializes in the creation of web-based platforms, mobile applications, machine learning solutions and IoT.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire SoCyber to accomplish?

• Identifying and Remedying Security Vulnerabilities
• Ensuring Regulatory Compliance
• Improving Operational Efficiency
• Protecting Sensitive Data

SOLUTION

How did you find SoCyber?

• Referral
• Other

Why did you select SoCyber over others?

• High ratings
• Close to my geographic location
• Pricing fit our budget
• Good value for cost
• Referred to me
• Company values aligned

How many teammates from SoCyber were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

SoCyber was engaged to conduct a thorough penetration testing of our internal ERP system, aiming to identify and assess potential security vulnerabilities that could be exploited by malicious actors. They performed both manual and automated tests, utilizing various techniques and tools to simulate real-world cyberattacks, allowing them to evaluate the system's defenses against different threat scenarios. 

The scope included ensuring regulatory compliance by aligning the ERP system's security protocols with relevant legal and industry standards such as GDPR, HIPAA, or SOC 2. A critical part of their work involved the protection of sensitive data within the ERP system, ranging from financial records to personal information, by fortifying the system's safeguards. 

Key deliverables included a comprehensive report detailing findings, vulnerabilities, risk assessments, and recommended remediation strategies, alongside continuous consultation and support for implementing the necessary security enhancements. Through this meticulous examination, SoCyber not only improved our system's security posture but also contributed to higher operational efficiency, reducing the risk of downtime and potential legal liabilities.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

Vulnerabilities were identified and remediated - a clear list of identified vulnerabilities, along with the measures that we need to take to fix them, showcased the tangible improvements made to the system's security. Meeting and even exceeding all relevant regulatory and industry standards, as confirmed through an external audit, demonstrated success in aligning the system with legal requirements. 

Reduction in potential risks was achieved - a quantifiable decrease in the number of potential security risks, as well as the severity of those risks, was a direct outcome of the testing and subsequent improvements on the system. The penetration testing of the system led to implementing of enhanced security protocols that are verified to be effective against specific types of attacks, showing the strengthening of the system's overall defenses. 

There were known weaknesses that could have led to data breaches, and these were successfully mitigated, which was a critical success factor in protecting sensitive information. The feedback from the internal stakeholders was extremely positive, the professional and efficient penetration testing and the measures taken after it has improved confidence in the system's security. 

A reduction in the time it takes to detect and fix security issues in the future was achieved through the detailed report that we received from SoCyber, which included detailed information how to keep the system secure.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

SoCyber's project management was highly professional and efficient. They established a clear timeline at the beginning of the project, outlining the various stages and expected delivery dates, and they consistently met or even exceeded those deadlines. Their on-time delivery demonstrated a strong commitment to maintaining the project schedule without sacrificing the quality of their work. In terms of responding to our needs, they were incredibly attentive and receptive. 

Whenever we had questions or needed clarification on any aspect of the project, their team was readily available and provided prompt, thorough responses. Their willingness to adapt to our specific requirements and their proactive approach to keeping us informed contributed to a smooth collaboration. Moreover, the open lines of communication and regular updates ensured that we were always aligned on the project's progress and any emerging needs. 

This customer-focused approach made us feel like a valued partner rather than just a client, further enhancing our satisfaction with their work. Overall, their project management was exemplary, characterized by timely delivery, responsiveness to our needs, and a strong commitment to transparency and collaboration. This experience not only contributed to our satisfaction with the project's outcome but also affirmed our decision to consider working with them again in the future or recommending them to others.

What was your primary form of communication with SoCyber?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

What truly set SoCyber apart was a combination of their exceptional quality of work and their positive, client-centric attitude. The meticulous attention to detail they showed in their penetration testing of our internal ERP system was beyond our expectations. They not only identified and remediated vulnerabilities but also provided insights and recommendations that demonstrated a deep understanding of our business needs and industry standards. 

Their attitude was equally impressive. Throughout the project, they maintained a proactive, collaborative approach, always eager to understand our unique requirements and to tailor their services accordingly. They made us feel valued and respected, and their enthusiasm and commitment to excellence were palpable in every interaction. 

In a field where technical expertise is often taken for granted, their ability to blend top-tier skills with genuine human connection made our collaboration not just productive but also enjoyable. It's this rare combination of technical prowess and positive attitude that makes them stand out as a truly remarkable partner in the cybersecurity domain. 

We wouldn't hesitate to work with them again or recommend them to others. Their approach serves as a model of how professional service should be delivered, making them unique in today's competitive landscape.

Are there any areas for improvement or something SoCyber could have done differently?

After a comprehensive review of SoCyber's work on our project, we found no areas for improvement, as their performance consistently met or exceeded our expectations in every aspect, reflecting their commitment to excellence and client satisfaction.

BACKGROUND

Please describe your company and position.

I am the Software Development Manager of Aqua Global Solutions

Describe what your company does in a single sentence.

We are a leading provider of financial message management solutions to the banking industry.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire SoCyber to accomplish?

Pen test

SOLUTION

How did you find SoCyber?

Networking event

Why did you select SoCyber over others?

Company values aligned

How many teammates from SoCyber were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

The key result of the web application penetration testing is to identify security vulnerabilities across the application and its components (source code, databases, backend system). It also helps in defining the priorities of vulnerabilities and threats and possible ways to reduce them. All communication channels from the app, including the APIs, are tested during the test! 

Some of the checks performed during the test include:

• Information Gathering Configuration and Deployment 
• Management Testing Identity 
• Management Testing Authentication 
• Testing Authorization 
• Testing Session Management 
• Testing Input Validation 
• Testing for Error Handling 
• Testing for weak Cryptography 
• Business Logic Testing 
• Client Side Testing

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

SoCyber provided great insights into the security of our web application. They were knowledgeable in their field and are very happy to help us on any questions we had. The results were clear for both technical and non technical people to read and their online portal, Kikimora, is easy to use.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

The project was a success from start to finish. The team were quick to respond to emails and questions and clearly identified the project timelines, which were met.

What was your primary form of communication with SoCyber?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

Their customer service is excellent.

Are there any areas for improvement or something SoCyber could have done differently?

I have no complaints

BACKGROUND

Please describe your company and your position there.

D Bank is a Bulgarian bank, that provides full specter of banking services both on the local market and abroad and I am the CISO.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire SoCyber?

We were looking for external cybersecurity company to perform an complex security/compliance audit of the payment gateway and payment apps of the bank in accordance with the EBA guidelines.

SOLUTION

How did you select this vendor and what were the deciding factors?

So-cyber were announced as winner out of 14 companies participating in a tender announced by the bank. We selected So-Cyber based on the amount of certified professionals as well as previous projects in financial institutions.

Describe the project in detail and walk through the stages of the project.

They performed three separate audits in accordance with the EBA guidelines over the Mobile banking app ( D Mobile), the Online banking app ( D Online) and the PSD2 payment gateway of the bank.

How many resources from the vendor's team worked with you, and what were their positions?

There were 4 people involved in the project. Project manager and 3 highly certified cybersecurity/compliance/audit professionals.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

They performed the requested audits across the different apps in very short time. The report was structured perfectly and was highlighting the real situation and representing the full picture.

How effective was the workflow between your team and theirs?

They kept us updated on every step of the audit and managed to perform each step flawlessly regardless of the complexity.

What did you find most impressive or unique about this company?

The most impressive part of the project was the ability to represent strong technical information in a readable form for none technical people.

Are there any areas for improvement or something they could have done differently?

All of the tasks were fulfilled in time and according to the best practice

BACKGROUND

Please describe your company and your position there.

I'm the CTO of a credit/debit card issuing company. We provide Card as a Service to other businesses.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire SoCyber?

We are required to perform an yearly PSD2 related audit for our customer authentication process in our mobile app.

SOLUTION

How did you select SoCyber and what were the deciding factors?

SoCyber were recommended by one of our "sister" companies. They had completed pretty much the same audit for them.

Describe the project in detail and walk through the stages of the project.

We own several mobile apps that share the same codebase and we needed an audit report for each one of them. The project was pretty straight forward on our side. We provided the required info about the apps and we issued one credit card per app which we provided to SoCyber. Then one by one, app by app we started receiving the audit reports prepared by SoCyber.

Fortunately we were compliant with the regulations so we didn't need to change anything in our apps.

How many resources from the SoCyber team worked with you, and what were their positions?

I am not sure. I think it was one person, but actually I didn't need to know this. The reports were delivered on the agreed schedule so I didn't ask any questions.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

It is a compliance project. The audit report was approved by the regulator so it was as successful as a compliance audit can be.

How effective was the workflow between your team and theirs?

I would say there was a workflow or any need for such in this project.

What did you find most impressive or unique about this company?

SoCyber was quick to deliver.

Are there any areas for improvement or something they could have done differently?

No.

BACKGROUND

Introduce your business and what you do there.

I’m the executive director of BenchMark Finance, an investment intermediary company. Our end clients use us to operate in the financial markets using stocks, forex, oil, gold, cryptocurrencies, and other financial instruments.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with SoCyber?

We recently used SoCyber for a partner company with which we shared our owners. For context, we were a target of cyberattacks and hackers. 

SOLUTION

What was the scope of their involvement?

SoCyber did penetration testing for our partner firm. 

What is the team composition?

We worked with one person. 

How did you come to work with SoCyber?

A colleague of mine — who no longer works with us — was in contact with them in 2017 as we were experiencing cyber- and hacking attacks. The owners of BenchMark were also friends with SoCyber’s owners. That was when our partnership started. 

How much have you invested with them?

We spent around €5,000–€6,000 (approximately $6,000–$7,000 USD). 

What is the status of this engagement?

This project occurred in July 2021. 

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement? 

We were happy with SoCyber. Our group was exposed to various cyberattacks, but after SoCyber’s work, the leaks stopped. This was the outcome that we wanted in order to be confident in our cybersecurity system.

How did SoCyber perform from a project management standpoint?

SoCyber’s project management skills were good. To communicate, we used phones and emails. 

What did you find most impressive about them?

I couldn’t compare them with other companies because I didn’t have experience with other providers. However, I was happy with their work. 

In the future, if we have more problems, I’ll ask SoCyber for help. 

Are there any areas they could improve?

No, there weren’t any. 

BACKGROUND

Please describe your company and your position there.

I am the owner of a company that provides Cybersecuirty Services.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire SoCyber?

We were looking for a specialist Pen Testing company to perform annual Cybersecurity Audit for one of our clients.

SOLUTION

How did you select this vendor and what were the deciding factors?

We searched online for a Pen Testing consultant, and selected SoCyber based on their experience and flexible offering.

Describe the project in detail and walk through the stages of the project.

SoCyber performed a thorough security check on our client's Assets and Infrastructure, and identified a number of risks and vulnerabilities. They produced a detailed report with recommendations on how these weak points have to addressed and rectified.

How many resources from the vendor's team worked with you, and what were their positions?

We had 1 Pen Tester, 1 Security Analyst and 1 Project Manager at our disposal.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

They identified vulnerabilities the client was not aware of. On top of that they shared know how and advised on best practices to avoid these in the future.

How effective was the workflow between your team and theirs?

They offered a very structured approach with a time plan and regular team meetings to update us on the work completed and what follows next.

What did you find most impressive or unique about this company?

We appreciated that they presented us with all of our options from day one, starting from the base one with the lowest budget, up to the most complex and thorough service.

Are there any areas for improvement or something they could have done differently?

A couple of tests took longer than expected, but the in-depth analysis paid off at the end.

BACKGROUND

Please describe your company and your position there.

TechnoLogica EAD was selected as the main contractor in a tender for the evaluation of cybersecurity of the IT systems of the Bulgarian Air Traffic Control Agency. I am head of the Security Solutions Dpt. in TechnoLogica. We participated in this public procurement procedure together with SoCyber. After the contract was awarded to TechnoLogica we subcontracted SoCyber.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire SoCyber?

SoCyber was subcontracted by TechnoLogica for penetration testing of Bulgarian Air Traffic Control Agency information systems and WEB services that are exposed to the Internet. Time was very short and we were challenged to provide all services and to deliver the related reports in a very short time.

SOLUTION

How did you select this vendor and what were the deciding factors?

We approached SoCyber through our common friend. He is a very experienced cyber Security expert and recommended SoCyber as a reliable and trusted partner. It was very important for me to find a partner that will not mislead us and that possess the necessary competencies and experience.

Describe the project in detail and walk through the stages of the project.

SoCyber performed a thorough security audit of the BULATSA web services and IT infrastructure, that are exposed to the Internet. They used a variety of tools for penetration testing, including tools for OSINT, Vulnerability Discovery, and Exploitation. After penetration testing operative tasks were completed SoCyber presented a report required by the End Customer information and with a list of security recommendations.

How many resources from the vendor's team worked with you, and what were their positions?

We had a project manager and security analyst. But we also received significant support from SoCyber during the bid itself.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Technical details from this project are confidential. The project was a big success for TechnoLogica and we are very glad about the corporation with Socyber results.

How effective was the workflow between your team and theirs?

The workflow between TechnoLogica and SoCyber team was very effective. Since the beginning of our join activities, we had a very clear scope and communication which helped us a lot. The project was fulfilled without stress and problems.

What did you find most impressive or unique about this company?

Very focused and effective work. SoCyber support was on time with the requested and expected quality. Reporting also was comprehensive and very useful for us.

Are there any areas for improvement or something they could have done differently?

Provided by SoCyber services and support were effective and fully compliant with the scope.

BACKGROUND

Please describe your company and position.

I am the Senior IT Security Consultant of AAM Consulting Bulgaria

Describe what your company does in a single sentence.

We provide IT consulting, IT Security Consulting, Project Management and Systems Implementation.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire SoCyber to accomplish?

To perform a network segmentation test for one of our clients.

SOLUTION

How did you find SoCyber?

Online Search

Why did you select SoCyber over others?

• Referred to me
• Company values aligned

How many teammates from SoCyber were assigned to this project?

1 Employee

Describe the scope of work in detail. Please include a summary of key deliverables.

The idea was to perform a segmentation test as per PCI DSS requirements and produce a report at the end. They had to verify that no access can be gained from out-of-scope networks to the cardholder data environment.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

The outcome of the successful project was the final segmentation test report.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

They did good in terms of project management. They were quick to act and assist when needed, finished the work on time, and showed a good degree of flexibility.

What was your primary form of communication with SoCyber?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

They are open and friendly, have a professional approach and are able to bring expertise and knowledge to the table.

Are there any areas for improvement or something SoCyber could have done differently?

None that I can think of.

BACKGROUND

Please describe your company and your position there.

We are affiliate marketing company that is oriented in the iGaming industry.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire SoCyber?

We contacted SoCyber to help us protect our website from malicious attacks.

SOLUTION

How did you select this vendor and what were the deciding factors?

One of our partners recommended us SoCyber.

Describe the project in detail and walk through the stages of the project.

Our cooperation began with a detailed consultation from their side. Furthermore, they performed variety of checks, penetration tests, and provided clear reports showing all required info. Also, they provide professional and friendly assistance each time we reach them out.

How many resources from the vendor's team worked with you, and what were their positions?

There were 3 Cyber Security Experts, one Project Manager, and their Head of Business Development. Overall, five people were involved in our project.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Thanks to SoCyber, we implemented variety of precautions and security measures, so that the security of our website is at the highest level.

How effective was the workflow between your team and theirs?

We performed personal meetings, video calls, and provided us with detailed reports. The communication with them is friendly, quick and professional.

What did you find most impressive or unique about this company?

We were impressed with their deep knowledge of what they were doing and their will to support.

Are there any areas for improvement or something they could have done differently?

We could not point such a thing.