UnderDefense

BACKGROUND

Please describe your company and your position there.

I'm CTO of state-owned enterprise which operates complex e-auction system

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire UnderDefense?

Our system is actually in use for several years, and during this time we didn't perform professional pen testing of it. Nowadays this is required to be sure that any important system should be checked if it's well-secured.

SOLUTION

How did you select this vendor and what were the deciding factors?

After researching and gathering feedback from industry we've contacted UnderDefense. They provided us with a personal account manager and clear contracting (tripartite agreement with our development vendor). Three main points for choosing were strong reputation, flexible timeline and reasonable price

Describe the project in detail and walk through the stages of the project.

After contracting we had:

• project planning with showing full scope of testing, schedule and expected result
• unning tests; during that pentesters contacted our specialists to understand how our system works in detail
• presenting the report (we had moderate- and low-level issues, some of them were already know and some were truly new for us)
• re-check (not performed yet because we're in the improvement state now)

How many resources from the vendor's team worked with you, and what were their positions?

At least 5 people: PM, AM and three engineers (probably more for particular tasks, but these guys contacted us directly)

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Two main outcomes:

• now I sleep much better from security perspective (despite of war which is currently going on in our country)
• there were some findings which proves that testing was performed with promised level of quality and details

How effective was the workflow between your team and theirs?

We had an online communication, all questions from both sides were answered quickly enough

What did you find most impressive or unique about this company?

Meeting all our (high) expectations in the execution itself + communication

Are there any areas for improvement or something they could have done differently?

Nothing to remember

BACKGROUND

Please describe your company and your position there.

Teamwork Commerce is a leading edge software development firm focused on the fashion and soft goods retail market, emphasizing a secure SaaS back office operation for retailers and Apple iPad mobile devices for use in stores. As VP Technical Services my focus is client and internal Infrastructure, Security, Training, Technical Writing, and Technical Support.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire UnderDefense?

In our efforts to continually improve our security posture, we were looking for a company to partner with for internal penetration testing, followed by an attempted social engineering attempt to access our networks and systems.

SOLUTION

How did you select this vendor and what were the deciding factors?

At this time, we have interviewed no less than 10 companies for the purposes of pen testing, and we found the approach and overall relationship with UnderDefense to be superior and wanted them to use their methodology and resources to test our systems.

In numerous conversations leading up to selecting UnderDefense, we asked many questions about their methodology and about follow up and follow through on their testing to help improve our security. In the end, UnderDefense seemed best suited to work with us to make those improvements.

Describe the project in detail and walk through the stages of the project.

The key project objectives included,

1. Identifying application-based threats to and vulnerabilities in the application
2. Comparing TeamWork Commerce current security measures with industry best practices
3. Providing recommendations that TeamWork Commerce can implement to mitigate threats and vulnerabilities and meet industry best practices
4. Provide feedback to Teamwork's SOC on improved methods and settings to detect threats in a more timely manner
5. Re-test at an appropriate time after risk mitigation.

The project included kick-off, scope and target alignment, penetration testing using UnderDefenses tools, coordination and collaboration on targets attained, verbal report on pen testing, written report on pen testing, recommendations for network security improvements, recommendations for SOC team improvements.

How many resources from the vendor's team worked with you, and what were their positions?

We had a senior level executive monitor our project which was run by a Project Manager, who had us work directly with 2 analysts and 2 pen testers.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

UnderDefense was able to find more threats and gaps that our internal team was able to identify. In the verbal review of their findings, they provided excellent guidance with regards to our current status versus current industry standards and what their observations are in the industry and how to evaluate that within our segment.

It was collaborative and enlightening. The details of the subsequent written report give us an excellent road map for risk mitigation. The combination of discussion and then written result gave us a better understanding of our next direction. Their professionalism, friendliness, and business rapport helped us get further faster.

How effective was the workflow between your team and theirs?

Very effective. As necessary we had project meetings; they were not intrusive, but rather properly timed. In addition an established Slack channel allowed us to have the occasional dialog which helped both teams move faster in attaining the final result.

What did you find most impressive or unique about this company?

It's hard to sum it up in one things. Responsiveness is definitely one factor worth mentioning, as the UnderDefense team was continually in contact with us during the project to keep us informed of progress and expectations, in addition to what I mentioned regarding Slack channel collaboration. Professional, but friendly is another impressive factor of the company....in many respects, they worked as if a part of our team in their management of the communication and the project itself.

Are there any areas for improvement or something they could have done differently?

Off hand, I do not have any recommendations for improvement. It was a well balanced team effort on UnderDefense's part, of which I found no weaknesses.

BACKGROUND

Please describe your company and your position there.

Uklon is the biggest ride-hailing service in Ukraine, which serves as a mediator that helps drivers and passengers with intersecting routes find each other. I’m a Cyber Security Manager, leading the team of 4-5 people, and taking care of security within the organization.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire UnderDefense?

We hired UnderDefense to conduct the Web Application, Mobile and Infrastructure security testing, we conduct annual pentests.

SOLUTION

How did you select this vendor and what were the deciding factors?

We were choosing between 5 companies, and conducted deep analysis of each vendor in regards quality of work, report samples, references and reviews. UnderDefense was the company that corresponded all our requirements, and proved their excellence during the project.

Describe the project in detail and walk through the stages of the project.

UnderDefense examined our web and mobile application's infrastructure and performed automated checks using the appropriate tools to discover the architecture and relation between applications. They mainly focused on analyzing the web application as a core part.

UnderDefense accelerated the assessment process using their rich background knowledge and dynamic code analysis. Afterward, they provided a series of recommendations for steps to take to protect ourselves.

How many resources from the vendor's team worked with you, and what were their positions?

The team consisted of 2 pentesters and a Project Manager.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Following this security testing, we are better equipped to avoid data breaches, improve IT and security processes, and continue following security best practices. They found security bugs in the app and delivered a report with all known issues. Additionally, they developed proof-of-concept scripts and code snippets that demonstrated how to practically exploit those weaknesses.

How effective was the workflow between your team and theirs?

It was good at all stages, good job was done during engagement with Client Success assigned to us, and during the project we had full support from PM and direct access to pentesters as well. We communicated via Slack Chat and had sync up calls.

What did you find most impressive or unique about this company?

We found UnderDefense to be a mature and passionate company. The process was well organized at each stage,they were always responsive.

Are there any areas for improvement or something they could have done differently?

We are very happy with this project and plan to continue our work with UnderDefense in the area of cyber security. Beside pentests, they also provide MDR services

BACKGROUND

Introduce your business and what you do there.

I’m a senior product manager at an identity management startup.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with UnderDefense?

We had to secure an ISO 27001 certification for our products and needed UnderDevense’s penetration testing services to fulfill the requirements.

SOLUTION

What was the scope of their involvement?

We provided UnderDefense with all the background information and application manuals they needed in order to examine our products. As part of their penetration testing efforts, they conducted thorough investigations to identify security vulnerabilities and any loopholes that could prevent us from getting the certification we needed.

What is the team composition?

We worked with about three resources from their team.

How did you come to work with UnderDefense?

They were onboarded before I joined the company.

How much have you invested with them?

We spent between $25,000–$50,000.

What is the status of this engagement?

Our project ran from October–November 2021.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

UnderDefense strategically utilized the information we provided, allowing them to deliver concrete results that helped us gauge our products’ efficacy.

How did UnderDefense perform from a project management standpoint?

We communicated via Slack. UnderDefense coordinated well with us, but we would’ve appreciated more detailed reports from their team.

What did you find most impressive about them?

We were most impressed with their capacity to generate cost-effective deliverables.

Are there any areas they could improve?

There wasn’t anything critical enough to be mentioned. We had a complex project, and UnderDefense did their best to help us.

Do you have any advice for potential customers?

Be open to exerting your time, effort, and money to get the results you need.

BACKGROUND

Please describe your company and your position there.

We are a USA-based startup focused on insurance simplification. We partner with carriers, banks, mortgage lenders, servicers, auto financiers, real estate companies, and more to save hours of work shopping for our clients.

My role at the company is to drive DevOps/DevSecOps.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire UnderDefense?

We take security very seriously, so we hired UnderDefense to test our business-critical web applications for potential vulnerabilities and security issues.

SOLUTION

How did you select this vendor and what were the deciding factors?

We searched for a few cybersecurity firms and made a comparison. Our primary deciding factors were: company reputation, pricing, and service package.

Describe the project in detail and walk through the stages of the project.

As soon as we provided all the necessary information, the UnderDefense team started identifying application-based threats and vulnerabilities in the applications. Then, they used Nessus, Nikto, SQLmap, Dirsearch for automatic assessment, and Burp Suite Pro for manual checks.

After test completion, the team delivered a report on all our risks and provided recommendations.

Also, UnderDefense will perform a second assessment of all findings after the remediation phase.

How many resources from the vendor's team worked with you, and what were their positions?

We've been working with the project manager and two penetration testers

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Vulnerabilities were found during the penetration testing process, leading to two attack cases: a web application and application victim-user. Both of them potentially lead to business issues.

How effective was the workflow between your team and theirs?

UnderDefense team provided weekly updates about the progress and agreed to notify us immediately if there was a critical vulnerability.

They answered any of our questions in detail and provided examples.

What did you find most impressive or unique about this company?

They are real experts in the services they provide. Also, they work as a team, and it is rarely a one-person job.

Besides, they had excellent communication and organizational skills. 

Are there any areas for improvement or something they could have done differently?

At the moment, I don't have any particular pieces of advice to give. UnderDefense is already excellent in its craft. Just keep going.

BACKGROUND

Please describe your company and your position there.

I am a senior manager in our cybersecurity advisory consulting practice and I lead all initiatives with our partners that support our engagements.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire UnderDefense?

We have hired UnderDefense on multiple occasions to support penetration testing needs for our clients as part of a larger existing project. Primarily, UnderDefense has provided external and internal network penetration testing and web application testing activities.

SOLUTION

How did you select this vendor and what were the deciding factors?

We selected UnderDefense because of the competency and competitive costs, as well as expertise in the penetration testing and threat space in cybersecurity. Largely, we are looking for a team to build as an extension to ours by leveraging partners like UnderDefense in order to show our expertise at our clients and able to communicate risks to the business.

Describe the project in detail and walk through the stages of the project.

Our stages of the project consists of obtaining the scope to obtain quotes from UnderDefense, onboarding Underdefense once price is agreed upon with client and our practice, scheduling penetration testing activities and obtaining necessary information to access systems.

UnderDefense has provided notifications in the past when testing is to start, and coordinates multiple calls to discuss status and debriefing of the report and findings walkthrough with detailed explanations of the results. Our practice then takes the report and has separate discussions with clients to discuss remediation strategies.

How many resources from the vendor's team worked with you, and what were their positions?

We worked directly with 3 to 4 people (including project manager) at the vendor's team.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

Technical expertise, manual and automated testing allowed us to get a full spectrum of all potential risks a hacker may see for the client's in-scope systems. Great reporting with overview executives (using our practice template), and supplemental technical reports by the pentesting team allowed us to portray the findings to our client and in-depth review.

How effective was the workflow between your team and theirs?

The workflow was very effective as we had set up a data repository site to share documents (reports) and through encrypted email, and leveraged texting and Microsoft Teams for collaboration and periodic checkpoints to discuss progress. We were on time with delivery and sometimes ahead of schedule from a testing perspective.

What did you find most impressive or unique about this company?

The most impressive or unique about this company is that they have additional capabilities that allow them to showcase expertise in the threat management space, not just penetration testing. Also, they work as a team and it is rarely a one-mans job. There is also project coordinator who is a one-stop go to person that helps coordinate and leads each project efforts which helps us communicate to our clients regarding updates and timelines.

Are there any areas for improvement or something they could have done differently?

I do not have anything significant of a request for UnderDefense to improve as they have been cooperative on each engagement (small or large), and always has a team behind the work.

BACKGROUND

Please describe your company and your position there.

Our business provides an online scheduling solution and my duties include legal and information security management within the organisation.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire UnderDefense?

As an ISO 27001:2013 company, it was time for our annual security assessment and penetration testing, on our web application and related infrastructure. Going with UnderDefense meant that we could fulfil our commitment to only obtain high-end services, valuable assessment and efficient cooperation with our provider for this important project.

SOLUTION

How did you select this vendor and what were the deciding factors?

UnderDefence performed the security assessment/penetration testing for our web application and related infrastructure last year. As we were very happy with the last year's results, it was an easy decision to seek their services again.

Describe the project in detail and walk through the stages of the project.

The initial communications (via email and video meeting) involved preparation for the project, to ensure everything (understanding of the project, our info etc.) were in order before the project begun. Importantly, they were happy to sign an NDA prior to sharing any info.

The on-going communication during the project took place via a slack channel dedicated to the individuals involved in the project. It was important that any questions and our feedback on those questions were easily communicated. Once the final report and communication of results were available a video meeting as well emails enabled to have a smooth conclusion of the project.

The phases to the project included an external perimeter, a web application and then interface and API penetration testing, followed by a remediation penetration testing.

How many resources from the vendor's team worked with you, and what were their positions?

The main personnel we were in contact with were the project manager and main security engineer, both which were very helpful throughout the process and stages.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

The testing results show an excellent security level from our end. This considered together with the good reputation of UnderDefense, our commitment towards our clients for the security of information will be maintained.

How effective was the workflow between your team and theirs?

The communication via the teams was very effective via emails or video calls and also via the dedicated slack channel,. We were able to ensure mutual understanding on the project due to that.

What did you find most impressive or unique about this company?

Their understanding of our needs prior to the start of the project ensured the project's success. This was the most impressive aspect of their services.

Are there any areas for improvement or something they could have done differently?

Although the overall communication during the project was very efficient, it mainly took place via emails and video meetings. It would be good to consider engaging in means such as a dedicated slack channel - for more prompt and easy communication. This is of course when possible/accepted by the team of UnderDefense.

BACKGROUND

Please describe your company and your position there.

IT Administrator at charity organization working worldwide. Using cloud infrastructure.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire UnderDefense?

We were looking for a company which would perform penetration testing of our applications, and security audit for our cloud infrastructure.

SOLUTION

How did you select this vendor and what were the deciding factors?

Searched online for pentesting companies, and UnderDefense was one of the first one's to respond and understand our requirements.

Describe the project in detail and walk through the stages of the project.

They performed penetration testing for our key services, which were mainly written in PHP. For some parts where penetration testing was not possible, they performed a code review which identified possible vulnerabilities. After this was done we were given a detailed report which included vulnerabilities, steps to reproduce and possible ways of mitigation, same we had a call where this report was presented and explain. In some time we were offered a 2nd fast test to identify if vulnerabilities were solved or not.

How many resources from the vendor's team worked with you, and what were their positions?

We had a project manager, and from to 2 to 3 security specialists who performed the testing

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

They identified vulnerabilities we knew about, and vulnerabilities and weak points in our system which we did not know about.

How effective was the workflow between your team and theirs?

They kept us updated on weekly basis. When we had questions, they were fast to answer.

What did you find most impressive or unique about this company?

Their team was flexible, and they arranged everything in quite a short time.

Are there any areas for improvement or something they could have done differently?

Offer more cost-effective and/or easy-to-implement solutions, as some of the solutions offered to us were not cost-effective for our company budgets. When presenting the report, have a person who can explain this in a less technical and more business perspective way, when presenting the report to the management team.

BACKGROUND

Introduce your business and what you do there?

I’m the information security manager for Dev.Pro. We provide outsourced software development to our customers.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with UnderDefense?

We developed an app for one of our customers, and they wanted a report of its security and vulnerabilities.

SOLUTION

What was the scope of their involvement?

UnderDefense conducted a cybersecurity audit on our client’s app. They provided a report from their first test which showed the vulnerabilities they found. They also worked with our internal development team and made recommendations on how to solve the vulnerabilities they identified. Once we followed their recommendations, they ran a second test on our client’s app to ensure that there were no bugs and that the speed was okay.

What is the team composition?

We interacted with 7–8 people, including people in client services and sales. However, we were only in direct contact with their project manager and two engineers.

How did you come to work with UnderDefense?

We found them on Clutch. We felt they were the best choice out of the companies we considered, and they met our customer’s location requirement.

How much have you invested with them?

We spent less than $10,000.

What is the status of this engagement?

We worked together from May–August 2021.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement? 

We were quite surprised that they were able to find many vulnerabilities, but because of them, we were able to save money for our clients and see good results. The app quality also improved because of their testing efforts. On top of that, we received good feedback from our clients and colleagues. Overall, we appreciated the services they offered, and we would be interested in partnering with them again in projects such as our semi-annual application testing efforts.

How did UnderDefense perform from a project management standpoint?

They provided simple and clear communication, and they worked in a timely manner. They finished the first phase of the audit or testing in roughly two weeks and the 2nd phase was completed within 2–3 weeks. We used email and Google Meet to communicate.

What did you find most impressive about them?

They had a high level of expertise in the services they provided. Furthermore, they had excellent communication and organizational skills. Compared to the work we had with other companies, we had a much better experience with UnderDefense.

Are there any areas they could improve?

No, they didn’t have any areas to improve.

Do you have any advice for potential customers?

Understand what you want, and clearly express your goals to them. UnderDefense will help you achieve them.

BACKGROUND

Please describe your company and your position there.

We are a cybersecurity consulting and services company. CTO.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire UnderDefense?

As a part of the service portfolio expansion we were looking to implement SOC/MDR offering and relied on the expertise of UnderDefense to identify scope, milestones, and plan to execute the project.

What were your goals for this project?

The project goals were to develop a cyber monitoring service that could be consumed internally and by our clients.

SOLUTION

How did you select UnderDefense?

UnderDefense is a mature organization with proved record and team that has demonstrated required expertise for this project.

Describe the project in detail.

The project entailed selection of the technology and validation of use cases. The service was intended to consume various sources of data, and creation of correlation rules and alerts which would produce reduced noise level data.

What was the team composition?

The internal team was limited. UnderDefense brought 3 resources - 1 project manager and 2 additional engineers.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

The final result of the project was deployment of cloud solution that had necessary compute and license capacity to accommodate the requirements and growth.

How effective was the workflow between your team and theirs?

Both teams has accepted simplified approach - the collaboration meetings were set when necessary, Project manager has kept everyone accountable and honest on the progress and milestones.

We had direct access to the engineering team and if necessary were able to make adjustments within the same day.

What did you find most impressive about this company?

UnderDefense leadership really understands the industry landscape and customer needs. The engineering resources assigned to the project had impressive skills and experience in the field.

Are there any areas for improvement?

We are all happy with the project delivery.