Syntetisk Tech

BACKGROUND

Please describe your company and position.

 I am the Marketing Lead of an information technology company 

Describe what your company does in a single sentence.

We are a software development company that builds AI-powered products and custom software for enterprises, including multi-agent AI systems, web and mobile applications, and cloud-native platforms.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Syntetisk Tech to accomplish?

• Run a comprehensive penetration test across our web applications, APIs, and cloud infrastructure to identify and eliminate security vulnerabilities before release.
• Validate our real-world security posture through deep manual testing combined with AI-assisted analysis — going well beyond what automated scanners detect.
• Receive clear, prioritized, developer-ready remediation guidance our engineering team could act on directly, followed by verification that fixes actually closed the issues.

SOLUTION

How did you find Syntetisk Tech?

• Online Search
• Referral

Why did you select Syntetisk Tech over others?

• High ratings
• Close to my geographic location
• Pricing fit our budget
• Great culture fit
• Good value for cost
• Referred to me
• Company values aligned

How many teammates from Syntetisk Tech were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

Syntetisk performed a practical, offensive-security penetration test across our production and pre-production environments, covering our web applications, REST and GraphQL APIs, and the underlying cloud infrastructure. Rather than relying on automated scanners alone, the engagement combined deep manual testing with AI-assisted analysis to maximize coverage while keeping findings accurate and free of noise. The testing methodology aligned with recognized industry standards, including the OWASP Top 10, OWASP API Security Top 10, and OWASP ASVS, and followed a structured process of reconnaissance, mapping, vulnerability identification, safe exploitation, and post-exploitation impact analysis. 

Key deliverables included: 

Web application penetration testing covering authentication, session management, authorization and broken access control (including IDOR), injection flaws, server-side request forgery (SSRF), cross-site scripting (XSS), and business-logic vulnerabilities. 

API security testing across REST and GraphQL endpoints, including authentication and authorization checks, rate limiting, mass assignment, excessive data exposure, and object-level access control. 

Infrastructure and cloud security testing covering external and internal attack surface, network exposure, misconfigurations, secrets management, privilege escalation paths, and hardening review of the cloud environment. 

AI-assisted testing workflows used to expand coverage and accelerate repetitive analysis, with every finding manually reviewed, validated, and confirmed by experienced consultants to rule out false positives. 

Safe exploitation with real proof-of-concept evidence, so each vulnerability was demonstrated rather than merely flagged. 

A detailed, professional penetration testing report including an executive summary, technical findings with severity and CVSS scoring, step-by-step reproduction, screenshots and evidence, clear business and technical impact, and actionable remediation guidance written for engineers. 

Remediation support and a verification retest to confirm that fixes were implemented correctly and the identified issues were fully resolved.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

The engagement gave us a clear, evidence-based picture of our security posture and directly reduced our risk before release. 

Key outcomes included: Identification of multiple vulnerabilities across web, API, and infrastructure layers, each with a validated proof of concept and clear severity rating. Critical and high-severity issues remediated and re-tested before the affected features went to production. A measurable improvement in our overall security posture, confirmed by the verification retest. A prioritized remediation roadmap that let our engineering team fix the most impactful issues first, with minimal back-and-forth. Concrete, reusable security guidance that improved how our developers approach authentication, authorization, and input handling in future work.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Syntetisk ran the engagement smoothly and professionally from start to finish. Scope was agreed clearly up front, communication was consistent throughout, and every milestone — including the final report and the retest — was delivered on time. They were responsive to our questions, coordinated testing windows around our environment to avoid disruption, and adjusted quickly when we needed to add clarity around scope. Findings were shared as they were discovered rather than held to the end, which let us start remediating critical issues immediately.

What was your primary form of communication with Syntetisk Tech?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

What impressed us most was the depth and honesty of their manual testing. They didn't just run tools and forward the output — they combined AI-assisted analysis with genuine hands-on offensive security expertise, safely exploited real issues, and proved impact with clear evidence. The report was one of the best we've seen: precise, well-prioritized, and written so our engineers could act on it directly without needing a security background to interpret it. It was practical security testing that matched the pace of our development, not a compliance checkbox.

Are there any areas for improvement or something Syntetisk Tech could have done differently?

No. The engagement exceeded our expectations, and we plan to work with Syntetisk Tech again for recurring assessments as our platform grows.