CyStack

BACKGROUND

Introduce your business and what you do there.

I’m a customer support manager at FireApps.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with CyStack?

We had a vulnerability in one of our applications. We investigated it for 3–4 months, but we weren’t sure if the problem was related to hackers or something outside the organization.

We had an internal QA team, but we didn’t have enough resources for security. Thus, we started looking for a company that could audit our app and advise us on fixing our problem to avoid it in the future.

SOLUTION

What was the scope of their involvement?

We initially gave our systems’ credentials to CyStack’s developers and researchers. They identified several bugs and vulnerabilities in our app, and they gave us detailed reports with screenshots and descriptions of how to reproduce the problems. 

CyStack had specific processes and tools in place. They signed an NDA as a contributor to the white hat community, stating that they wouldn’t share information specific to our system.

What is the team composition?

CyStack assigned a five-person team to us, including a team lead.

How did you come to work with CyStack?

Our CEO found CyStack on Google and read some of their reviews. We had an introduction call with one of their account managers and signed a contract.

How much have you invested with them?

We spent a little over $10,000.

What is the status of this engagement?

We worked with CyStack from December 2020–January 2021.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

CyStack worked 24/7, which helped them found bugs sooner, giving us more time to fix them. We didn’t understand the bugs or their impact at times, but their researchers worked closely with us on them. They also put in place a system to prioritize issues based on severity.

This was the first time we hired an outside security firm to investigate our system, so we didn’t have a reference point. However, we were happy with CyStack’s team and the results, and we plan to work with them again in the future.

How did CyStack perform from a project management standpoint?

As we wanted to fix everything within a month, CyStack agreed to work during weekends, and they delivered even earlier than the deadline. We created a Skype group, where we posted any questions we had and followed up on urgent bugs. At the end of the process, they spent 3–4 days discussing with us what they found and how we could avoid the same problems in the future.

Our communication was also great. I kept in touch with the account manager throughout the project. I even sent her questions during the night, and she always answered quickly.

What did you find most impressive about them?

CyStack worked very hard on the project, and they found a lot of bugs since day one. They were very focused on the project. 

Are there any areas they could improve?

I don’t have anything constructive to say. The project turned out quite well.

Do you have any advice for future clients of theirs?

Think critically about your systems. Before working with CyStack, we were upgrading our applications very fast, and we weren’t focusing on security. However, they uncovered a lot of issues, including small mistakes made by our developers, so it made us rethink our security compliance.

We thought we weren’t making mistakes, but there were a lot of them. We also thought that these were normal problems that we could fix easily, but any hacker that discovered those vulnerabilities could have hacked our system, and we would have lost money, data, and customer trust.

CyStack has an international security certification, and they’re verified by peer security organizations. They’re a good option for companies like ours.