CQR Company

BACKGROUND

Please describe your company and your position there.

I'm a CTO at crypto company

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire CQR Company?

We needed to check the reliability of transactions and the storage of information about them in our system.

SOLUTION

How did you select this vendor and what were the deciding factors?

We looked at the price and technology. We decided it was a profitable and fast solution.

Describe the project in detail and walk through the stages of the project.

There were several technologies that our company ordered for 3 months. During this time, we found vulnerabilities and flaws in our system. CQR experts recommended some of their services based on our needs. The ordered services included penetration testing as well.

How many resources from the vendor's team worked with you, and what were their positions?

We talked to a total of about 6 people about all the issues.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

As a result, we received information about the security status of our data and preventive measures against potential attacks. Also, we think that it is reasonable to conduct a re-test after we fix the detected bugs.

How effective was the workflow between your team and theirs?

We liked everything.

What did you find most impressive or unique about this company?

The speed of the team and their own technology, it's something new on the market.

Are there any areas for improvement or something they could have done differently?

Their team was very experienced and had good technology. Their price is also reasonable, so I can't find any shortcomings.

BACKGROUND

Please describe your company and position.

I am the Chief Business Development Officer of Arrible

Describe what your company does in a single sentence.

Development of Apps and Games

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire CQR Company to accomplish?

Penetration project for our multiple assets in with a big scope.

SOLUTION

How did you find CQR Company?

• Online Search
• Referral

Why did you select CQR Company over others?

• High ratings
• Pricing fit our budget
• Great culture fit
• Good value for cost
• Company values aligned
• Other

How many teammates from CQR Company were assigned to this project?

2-5 Employees

What was your primary form of communication with CQR Company?

• Virtual Meeting
• Email or Messaging App

Describe the scope of work in detail. Please include a summary of key deliverables.

Objective: 

• The primary goal of the penetration testing is to identify vulnerabilities and weaknesses in our website and game, both from a technical and application security perspective. By simulating real-world attack scenarios, we aim to assess our systems' resilience and identify improvement areas. 

Scope: 

• Website Penetration Testing: Conduct a thorough assessment of the website's architecture, including backend infrastructure and server configurations. Perform vulnerability scanning and manual testing to identify common web application vulnerabilities (e.g., SQL injection, cross-site scripting, etc.). Evaluate the effectiveness of access controls, authentication mechanisms, and session management. Test for potential misconfigurations and security weaknesses in network components (e.g., firewalls, routers, etc.) that may impact the website's security. 
• Game Penetration Testing: Evaluate the game's client-server communication to identify potential vulnerabilities and data integrity risks. Assess the game's codebase for common programming flaws and security vulnerabilities. Test for any potential weaknesses in anti-cheat mechanisms or unauthorized access points. Assess the overall resilience of the game's architecture to withstand external attacks. 
• Social Engineering (Optional): If agreed upon, conduct social engineering attempts (e.g., phishing emails, phone calls) to assess the susceptibility of our employees to such attacks. Provide recommendations on improving security awareness and training programs.

Based on the scope outlined above, the following deliverables are expected: 

• A comprehensive penetration testing report detailing the vulnerabilities, weaknesses, and potential impact discovered during the assessment. 
• Recommendations for mitigating identified vulnerabilities, including prioritization based on risk severity. 
• Any additional findings, observations, or suggestions for enhancing the overall security posture of our website and game.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

We would like to express our appreciation to CQR for their exceptional work in conducting the penetration testing for our website and game. The engagement has provided valuable insights into the security posture of our systems and has greatly contributed to enhancing our overall security measures. 

We are pleased to provide a review of the work performed, focusing on the measurable outcomes that demonstrate progress and success achieved through this project: 

• CQR successfully identified a significant number of vulnerabilities in both our website and the game. Their thorough assessment and testing methodologies revealed vulnerabilities such as SQL injection, cross-site scripting, and misconfigurations in our network components. 
• The project's comprehensive list of identified vulnerabilities was an essential outcome, enabling us to prioritize and address security risks effectively. We are impressed with the prompt and efficient recommendations provided by CQR to mitigate the identified vulnerabilities. 
• Their expertise and guidance allowed us to implement effective remediation measures, reducing the potential for exploitation and enhancing the security of our website and game. The collaborative approach taken by [Penetration Testing Provider] in assisting us throughout the mitigation process has been invaluable. Through the rigorous penetration testing conducted by CQR, we have significantly improved the resilience of our systems. 
• The implementation of their recommendations and insights on the overall security posture have bolstered our defences against potential attacks. We have observed increased robustness in our website's architecture, enhanced client-server communication security in the game, and strengthened anti-cheat mechanisms, all contributing to a higher level of resilience.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

A team of managers and pen tests worked with me. I had the opportunity to hold meetings and ask all the questions I was interested in. And, of course, to get answers.

What did you find most impressive or unique about this company?

One of the most impressive and unique aspects of the company that provided these services to us, was their comprehensive and thorough approach to the penetration testing engagement. They exhibited a deep understanding of the game development industry and demonstrated high expertise in assessing the security of both our website and game.

Are there any areas for improvement or something CQR Company could have done differently?

They were excellent in all areas of the project.

BACKGROUND

Please describe your company and your position there.

I'm a Head of the Information Research Center at web software development firm

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire CQR Company?

We were looking for fast and effective technologies to protect our company's data. We liked the number and description of the technologies. We were looking for a comprehensive approach.

SOLUTION

How did you select this vendor and what were the deciding factors?

It seemed to us that this particular company would give us the quality we wanted. In the end, we are very satisfied with all the technologies that we were offered and carried out by the specialists.

Describe the project in detail and walk through the stages of the project.

Regular communication, reporting on the work of technologies, and new updates. In addition to the technology, most of the time we used technologies to prepare for PCI-DSS certification.

How many resources from the vendor's team worked with you, and what were their positions?

There are about 4-6 specialists.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

We have a job well done and a report with recommendations to avoid potential hacks. We have received PCI-DSS certification, and now we are confident in the complete protection of the computing network, the unbreakable configuration of components in the infrastructure, and our physical cyber defense methods. Because we even have international proof of this!

How effective was the workflow between your team and theirs?

My boss and I personally communicated with the team at a convenient time for us. It was productive.

What did you find most impressive or unique about this company?

The efficiency of the technology amazed my boss. :) We met all the deadlines.

Are there any areas for improvement or something they could have done differently?

I would like more hours because when you finish cooperation, you understand how many more important technologies you want to apply.

BACKGROUND

Please describe your company and your position there.

I'm a Director of IT at a heating systems company.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire CQR Company, and what were your goals?

We wanted to find a simple and fast option to ensure the security of our data. The emphasis was on specialized equipment and IoT elements.

SOLUTION

How did you select this vendor and what were the deciding factors?

We liked the system of paying by the hour. That way, we saved some money.

Describe the scope of work in detail, including the project steps, key deliverables, and technologies used.

The first technology was Vulnerability Assessment. After that, other monitoring technologies were selected. We have been cooperating for 4 months. We can admit that everything went smoothly and CQR specialists promptly contacted us to report the most critical vulnerabilities that should be fixed immediately.

How many people from the vendor's team worked with you, and what were their positions?

We had a project manager and 3 cybersecurity specialists.

RESULTS & FEEDBACK

Can you share any measurable outcomes of the project or general feedback about the deliverables?

Among the results, our security department says that we see the level of data confidentiality, the likelihood of unauthorized access or use of information, and the locations and causes of potential leaks. And, the absence of reputational and financial losses due to lack of data security can be called the main thing that we have received. It was a great experience. And we will consider other CQR company’s technologies that might be useful for our business.

Describe their project management style, including communication tools and timeliness.

Everything about the project management is fine. They gave us all the feedback on the job at once.

What did you find most impressive or unique about this company?

Personally, I was impressed that the client can control almost everything. You can even set up audit notifications, that is, what exactly they track and find. Right on my phone, I could see where exactly a hacker could leak my company's information.

Are there any areas for improvement or something they could have done differently?

We would like to devote more hours to our own cybersecurity.

BACKGROUND

Please describe your company and your position there.

We are the leading Internet provider in Kyiv. We present its services on the market of telecommunications services in Ukraine, providing the services of a communication operator not only in the capital but also in the region. I am the head of the cybersecurity department.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire CQR Company?

We saw an opportunity to conduct a course on Social Engineering among the company's management and employees. We needed it because we had already faced phishing attacks through our employees.

SOLUTION

How did you select this vendor and what were the deciding factors?

We liked the uniqueness of the proposal. We haven't heard so much detail about the course yet. We were set up for an incredible result!

Describe the project in detail and walk through the stages of the project.

First, there were the modeling and the social engineering methods themselves. Then we were given the results of an in-depth analysis of how prepared our employees were for an attack with modern methods of social engineering, and how successfully they were able to prevent it. We also found out how much important information we had not been able to protect. The timing of the course was adjusted to suit us. We wished it to be about 3 weeks. It felt like we immersed ourselves and learned all the methods and ways to confront Social Engineering completely!)

Along with that, we understand that even cybersecurity specialists need to be trained on a regular basis. There is always somebody who knows certain areas better than you. We understand that we rather invest in ourselves and pay a fair price for CQR company’s services than become victims of inventive hackers.

How many resources from the vendor's team worked with you, and what were their positions?

4 leads and several cybersecurity specialists were with us all the time.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

We took tests and learned quite deep and professional aspects of cybersecurity. Now we plan to prepare for international exams and order training for certification in CQR next year. We will consider other CQR companies’ services. At the moment, we would like to take a close look at their automated platform. So, we will reach our management and request them to order some hours for us to work with that platform.

How effective was the workflow between your team and theirs?

As a result, our staff has become aware of social engineering techniques. And, the course has increased my personal knowledge in the field of Social Engineering. My supervisors and colleagues were also satisfied.

What did you find most impressive or unique about this company?

The individual approach of their employees was impressive.

Are there any areas for improvement or something they could have done differently?

The only problem was that not all of our employees wanted to take this course, but we have already solved this issue :)

BACKGROUND

Please describe your company and position.

I am the Head of Sales of WEBA

Describe what your company does in a single sentence.

Integrating and implementing CRM systems. Odoo, Creatio

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire CQR Company to accomplish?

• Red Team Services, Cybersecurity

SOLUTION

How did you find CQR Company?

Online Search

Why did you select CQR Company over others?

• Pricing fit our budget
• Good value for cost

How many teammates from CQR Company were assigned to this project?

6-10 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

The project involved a thorough Red Team assessment by CQR Company to enhance cybersecurity. 

• Planning: Defined scope, objectives, and communication channels. 
• Reconnaissance: Gathered info to identify potential targets. 
• Scenario Dev.: Created realistic attack scenarios. 
• Assessment: Simulated attacks - phishing, exploits, unauthorized access. 
• Vuln. Analysis: Explored weaknesses, executed controlled exploits. 
• Post-Exploitation: Showcased data exfiltration, unauthorized access. 
• Reporting: Detailed findings, security posture overview, recommendations. 
• Remediation: Offered actionable recommendations, collaborated on implementation. 
• Training: Shared insights, provided guidance on best practices. 
• Follow-Up: Post-assessment support, periodic check-ins on enhancements. CQR Company's professionalism and technical expertise greatly bolstered our cybersecurity readiness.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

The Red Team assessment by CQR Company led to these notable outcomes: 

• Vulnerability Mitigation: Addressed critical vulnerabilities, reducing attack surface. 
• Incident Response: Refined procedures for quicker, more effective responses. 
• Employee Awareness: Heightened vigilance against social engineering attacks. 
• Strategic Investments: Focused resources on key security needs. 
• Enhanced Partnerships: Improved collaboration between IT and cybersecurity teams. 
• Data Protection: Strengthened measures against data exfiltration. 
• Measurable Gains: Reduced vulnerabilities post-implementation. 
• Reputation Boost: Demonstrated commitment to robust cybersecurity. In essence, the project achieved improved security readiness and proactive defense.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

CQR's skilled team performed penetration testing, social engineering, and exploitation techniques, offering valuable insights into our security posture and recommendations for improvement. Their professionalism, technical expertise, and actionable results greatly contributed to enhancing our cybersecurity defenses. We highly recommend CQR Company for organizations seeking effective Red Team assessments.

What was your primary form of communication with CQR Company?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

CQR's standout Red Team expertise brought concrete security enhancements, better incident response, and informed investments. Their collaborative approach and post-assessment support amplified our cybersecurity readiness.

Are there any areas for improvement or something CQR Company could have done differently?

We didn't notice anything that could be improved.

BACKGROUND

Please describe your company and your position there.

I'm a Head of the management center at Crypto Company.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire CQR Company?

Our partners and competitors often face hacker attacks, so we decided to find effective cybersecurity services.

SOLUTION

How did you select this vendor and what were the deciding factors?

We considered different price categories of services. To be honest, this is the main criterion by which we decided to write the CQR. Then we realized that they have much more privileges.

Describe the project in detail and walk through the stages of the project.

We ordered DarkNet Tracking, Smart Contract Audit, and IoT Audit. The first stage of our cooperation helped us a lot, we modeled the threats we had and decided what exactly will help to avoid them. Then CQR specialists worked on these technologies. For example, Smart Contract Audit began with an in-depth code review and automated testing, and then we were given the audit report. We were also advised to order social engineering training, since we have offices in various countries and we are a fast-growing company, we have a lot of new employees. And, frankly, even some branch managers have never seen each other in real life. We understood that not being aware of social engineering techniques makes us open to hackers. We will definitely order those courses from the CQR company soon.

How many resources from the vendor's team worked with you, and what were their positions?

The whole CQR team worked with us, but constantly and most of all there were 4 cybersecurity specialists to whom we asked questions in the course of cooperation.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

They spent many hours auditing our system, during which we have seen how the CQR team finds and identifies every vulnerability. For example, IoT Audit found vulnerabilities in the software of all our specialized equipment. The provided report on smart contracts audit contained a detailed description of all the potential vulnerabilities, both in code and in smart contract’s behavior. CQR specialists proposed steps to eliminate those threats, and we gained knowledge of the most common logical errors, cryptography issues, and best practices.

How effective was the workflow between your team and theirs?

Quite effective

What did you find most impressive or unique about this company?

Cybersecurity provided us with such innovative technologies that we have never even heard of. It was a very fast and interesting collaboration.

Are there any areas for improvement or something they could have done differently?

I cannot say that we were dissatisfied with something, we will order other CQR services.

BACKGROUND

Please describe your company and your position there.

I am a cyber security specialist. We are an IT company that provides hosting services.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire CQR Company?

We needed full data protection and consulting services: we have many virtual systems, equipment, etc.

SOLUTION

How did you select this vendor and what were the deciding factors?

At the first consultation, we understood the level of awareness and literacy of the specialists. We were impressed that everything was individual. Afterward, everything we asked was explained to us.

Describe the project in detail and walk through the stages of the project.

We plan to continue cooperation because the hours we ordered are over. We will order other technologies from the company. Now we also understand the necessity to constantly evaluate the level of cyber protection, and implement all the latest updates and appropriate settings.

How many resources from the vendor's team worked with you, and what were their positions?

The head of the department and the specialists from the company staff were with us.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Mostly, we focus on the system status report and recommendations from the team to avoid future attacks. We also intend to obtain HIPAA, GDRP, and NIST certifications with their help.

How effective was the workflow between your team and theirs?

They are efficient, fast, and high quality.

What did you find most impressive or unique about this company?

Value for money of cybersecurity services.

Are there any areas for improvement or something they could have done differently?

Our team has no comments.

BACKGROUND

Please describe your company and your position there.

I'm CTO at Internet & Cable. We are an authorized retailer of multiple Internet, Cable TV and Phone service providers. We specialized in finding the best internet deals for our clients.With master bits of knowledge accumulated through persevering exploration, we monitor the advantages and disadvantages of Internet Service Providers (ISPs) across America. We make contrasting ISPs straightforward by following everything from paces and costs to expenses and gear. We share what we find in simple to-analyze graphs and reports so you can settle on the best web decisions.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire CQR Company?

We were not able to optimize access to the system safely. We had a case of a hacker attack, so we decided to see if there were any consequences.

SOLUTION

How did you select this vendor and what were the deciding factors?

Our company went through several options and chose CQR because of its impressive technology.

Describe the project in detail and walk through the stages of the project.

It was at least three technologies: Continuous Infrastructure Monitoring, Breach Detection, and DarkNet Tracking. For us, they were doing exploit monitoring, source code analysis, vulnerability management, and much more.

How many resources from the vendor's team worked with you, and what were their positions?

We had 4 specialists and managers

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

We have received full information about the state of data security. We got scalability, access optimization, and adaptability of the system. The area of our business requires high-security standards that need to be met. Based on our experience, we could rely on CQR company!

How effective was the workflow between your team and theirs?

So, it was efficient and qualitative. Our expectations were met.

What did you find most impressive or unique about this company?

We talked a lot with the team. Each technology was implemented for us. It was not something template and standard, like mass-market services. It's really nice, I guess.

Are there any areas for improvement or something they could have done differently?

Something can always be improved, but I am not a cybersecurity specialist. I just saw the result we expected, everything was ok!

BACKGROUND

Please describe your company and your position there.

I'm a Co-founder of an oil refining company

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire CQR Company?

We were concerned about the security of our clients' data. We wanted to check the state of the security system.

SOLUTION

How did you select this vendor and what were the deciding factors?

To be honest, we were impressed with the price and the number of technologies on the site.

Describe the project in detail and walk through the stages of the project.

Network Security Assessment and Vulnerability Management are the main technologies that the team has offered us. We were able to observe the process and ask questions. It was a "careful" maximum pentest, to the extent that the company's experts did not touch the network architecture.

In the first stage, CQR specialists performed BlackBox testing. Following the BlackBox testing report, we implemented the suggested remediation. However, the pentest is limited in terms of its duration. We understood that it was not possible to cover all our infrastructure, especially within the tight time limits.

So, CQR managers advised us to determine the most critical components and conduct a WhiteBox pentest. We were impressed by the results we got. It has emerged that we had a couple of critical vulnerabilities that could have allowed a malicious person to compromise our entire system and steal all the confidential data.

How many resources from the vendor's team worked with you, and what were their positions?

We had several cybersecurity specialists.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

We have the result that the CQR team promised us. We spent all the time monitoring vulnerabilities. Now we know the security level of our network, we have the plan to fix potential problems. We have been told how to reduce further risks to zero within the technology we have. We have methods to maintain the proper level of security. We will continue our cooperation with the CQR company, and we will order a re-test soon.

How effective was the workflow between your team and theirs?

Our cooperation was pretty effective.

What did you find most impressive or unique about this company?

We expected a much more expensive price.

Are there any areas for improvement or something they could have done differently?

I can't say that we were dissatisfied with anything, we will order other CQR services next year.