Veribreak LLC

BACKGROUND

Please describe your company and position.

 I am the Senior Application Security Engineer of an information technology company 

Describe what your company does in a single sentence.

Remote is a global HR platform that helps companies hire, pay, and manage employees and contractors anywhere in the world, handling payroll, benefits, taxes, and local compliance through our own owned entities.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Veribreak LLC to accomplish?

• Get a full penetration test of the internal web applications our staff use every day, to find vulnerabilities before an attacker or a malicious insider could.
• Test our internal network for weak configurations, exposed services, and paths an attacker could use to move laterally between systems once inside.
• Meet our annual penetration testing requirement for compliance, with documentation and a retest report we could hand to auditors.
• Receive a clear, prioritized report our engineering team could act on, with enough detail to reproduce and fix each issue.

SOLUTION

How did you find Veribreak LLC?

Referral

Why did you select Veribreak LLC over others?

• Pricing fit our budget
• Great culture fit
• Good value for cost
• Company values aligned
• Very Professional, and really impressive work

How many teammates from Veribreak LLC were assigned to this project?

6-10 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

Veribreak carried out a full penetration test of our internal web applications and the internal network they sit on. The applications in scope were the tools our own staff use daily, so the testing covered authentication, session handling, access control between roles, business logic, and the ways a low privileged user could reach data or functions they should never see. On the network side they looked at exposed internal services, weak and default configurations, credential handling, and the paths an attacker with an initial foothold could use to move laterally toward higher value systems.

They ran the engagement in two phases. First a black box pass with no prior knowledge, to see what an attacker starting from a standard employee account would actually find. Then a credentialed and grey box pass where we gave them accounts across different permission levels, which is where the more serious access control problems surfaced.

The results were better than we expected. They found several high severity issues that had been in our environment for years and had gone unnoticed through previous testing, including a privilege escalation chain that let a normal user reach administrative functionality. Every finding was manually verified rather than pulled from a scanner, which meant no time wasted on false positives.

Key deliverables:

1. Full technical report with each finding rated by real world impact, not just a generic score
2. Step by step reproduction for every issue, detailed enough that our engineers could confirm it themselves
3. Exploitation evidence and screenshots for the critical and high findings
4. Remediation guidance written for our stack rather than copied from a template
5. An executive summary we could take to leadership and to our auditors
6. A live walkthrough session with our engineering team to talk through the chained findings
7. Free retest and a formal retest report once we shipped the fixes

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

• Veribreak identified 44 total findings across the internal applications and network, including 4 critical and 12 high severity issues. Several of these had been present in our environment for years and were not picked up by previous testing or by our automated scanning.
• One privilege escalation chain allowed a standard employee account to reach administrative functionality. This was the single highest impact finding of the engagement and had been exploitable for a long time without our knowledge.
• Zero false positives. Every reported issue was manually verified and reproducible by our own engineers, so no engineering time was spent triaging noise.
• Communication has been consistently strong. Questions from our engineering team get answered the same day, and they have been available for direct discussion rather than routing everything through a project manager.
• The readout call and remediation support are scheduled and in progress, and they have been proactive about walking our team through the higher severity findings rather than leaving us with a document to interpret alone.
• The engagement is tracking to the agreed timeline with no scope creep and no surprise costs.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Project management has been solid throughout. Scoping was handled properly before any testing started, so there was no back and forth later about what was in or out of scope, and the timeline they gave us at kickoff is the one they have been working to.

They kept us informed as the engagement progressed rather than going quiet and reappearing with a report. Critical findings were flagged to us as soon as they were confirmed, which let our engineers start on the most serious issues right away instead of waiting for a final document. Status updates came without us having to chase them.

Responsiveness has been one of the strongest parts of working with them. Questions from our engineering team get answered the same day, and we have been able to talk directly to the testers doing the work rather than passing everything through an account manager. When we asked for extra detail on a finding or wanted to walk through the impact, they made time for it.

They have been genuinely helpful beyond the contracted scope. The readout call and remediation support have been collaborative, and they have taken the time to make sure our team actually understands the findings rather than just handing over documentation and moving on. Highly professional throughout, and easy to work with.

What was your primary form of communication with Veribreak LLC?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

• The speed of getting started. Testing began within 24 hours of our kickoff call. In our experience most vendors take a week or more to move from signed scope to actual work, so this was a noticeable difference.
• Flexibility on timing. They worked around our schedule rather than the other way round, which mattered because these were the applications our staff use all day. We were able to agree windows for the more intrusive testing without disrupting the business.
• The depth of skill on the testing side. These are clearly experienced testers rather than people running tools and forwarding the output. They found long standing issues in our environment that previous testing and our own scanning had missed, and the quality of the manual work is what made the difference.
• The report needed no rework from us. It came back compliance ready, which is rare. We have had engagements before where the deliverable had to be reformatted or expanded before it was usable for an audit, and none of that was necessary here. Findings were clear, evidenced, and written so both our engineers and our auditors could work from the same document.
• We had a shared Slack channel with their team and questions from our engineering team were usually answered within minutes.

Are there any areas for improvement or something Veribreak LLC could have done differently?

Nothing on the technical side. The only gap is visibility. We found them through a personal reference and would not have come across them otherwise. They are better known by word of mouth than by search, and more published work would help teams shortlisting vendors find them.

BACKGROUND

Please describe your company and position.

 I am the Co-Founder & CEO of a security talent intelligence company.

Describe what your company does in a single sentence.

We provide a Security Talent Intelligence platform powered by proprietary algorithms. We are the only platform that maps a candidate's cognitive patterns through live-fire, no-flags Enterprise scenarios to predict real-world security performance.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Veribreak LLC to accomplish?

• Deliver an independent penetration test of our platform, a security talent product that runs live, multi tenant enterprise environments. Assess the core web application, the supporting APIs, the AI chatbot, and the separation between candidate environments against real attack scenarios.

SOLUTION

How did you find Veribreak LLC?

Referral

Why did you select Veribreak LLC over others?

• Pricing fit our budget
• Good value for cost
• Referred to me
• Company values aligned

How many teammates from Veribreak LLC were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

We brought in Veribreak to run a full penetration test on our platform, and they delivered. 
Rather than treating our web app, API layer, and AI chatbot as separate boxes to check off, their team looked at the whole system as connected surfaces, which is exactly what we wanted.

The scope covered our main application across all three of our user roles (triager, practitioner, and admin), plus the backend API and the newer AI features we'd added.

One thing that stood out was the attention they paid to the authorization boundaries between candidate environments and the core platform which was critical. That's a tricky area to test properly since it requires understanding the business logic, not just running automated scans, and it was clear they'd taken the time to actually understand how our system is supposed to behave before trying to break it. Every finding they brought to us had been manually verified first, so we weren't chasing down false positives or scanner noise. They also rated everything by real-world impact rather than just handing us a generic severity score, which made prioritization on our end much easier.

The final report came with clear evidence and reproduction steps, so our engineering team could pick it up and start remediating without needing a lot of back-and-forth clarification calls. Overall, this felt like working with a team that understood our platform's architecture, not just a checklist of common vulnerabilities. We'd recommend Veribreak to any company that needs testing across a mix of modern tech - web, API, and AI-driven features and wants a actionable deliverables.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

This was our first PT engagement. As a cybersecurity talent company ourselves, we held high expectations. They found some interesting stuff we had missed internally. The depth of their findings and clear reporting made it a success for us.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

The team consistently met deadlines, communicated effectively, and quickly addressed any issues or feedback.

What was your primary form of communication with Veribreak LLC?

Virtual Meeting

What did you find most impressive or unique about this company?

The technical depth of their team, aligned vision, and clear communication were commendable.

Are there any areas for improvement or something Veribreak LLC could have done differently?

For the scope of what we wanted to get, Veribreak delivered upto our expectations. I just wish and hope they uphold the same level of work as they scale. 

BACKGROUND

Introduce your business and what you do there.

I’m the founder and CEO of an IT services company. We develop software products for healthcare, pharmaceutical, and laboratory companies.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Sudarshana Labs?

We were working on a software product for a laboratory information management system (LIMS). We hired Sudarshana Labs to help us find security issues in our system.

SOLUTION

What was the scope of their involvement?

Sudarshana Labs has performed security tests on our LIMS system. The team has provided a well-documented report.

What is the team composition?

We’ve worked with 2–5 teammates from Sudarshana Labs.

How did you come to work with Sudarshana Labs?

We found them through a referral. We chose them over other options because they had high ratings, their pricing fit our budget, they offered good value for the cost, and their company values aligned with ours.

What is the status of this engagement?

We started working with them in January 2025, and the engagement is ongoing.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

Most of the security issues have been found by the Sudarshana Labs team, so all the possible ways for attackers have been found, and we’ve already prevented those points. Overall, we’ve increased our confidence in our system.

How did Sudarshana Labs perform from a project management standpoint?

They meet all the deadlines. We communicate via virtual meetings, emails, and messaging apps.

What did you find most impressive about them?

They provide good outcomes. Other companies can find 30 security issues in the same domain, while Sudarshana Labs can give 40%–50% more outcomes.

Are there any areas they could improve?

I'm very satisfied with the result. They’re doing their best.