WebSafety Ninja

BACKGROUND

Please describe your company and your position there.

I am founder and Chief Product Officer at Talexio

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire WebSafety Ninja?

We commissioned WebSafetyNinja to run a number of penetration tests on our cloud based product.

SOLUTION

How did you select this vendor and what were the deciding factors?

We asked around for recommendations and we also searched online for such software providers.

Describe the project in detail and walk through the stages of the project.

We had a couple of initial meetings with the team at WebSafetyNinja. We created test accounts on the live system and also on our staging environments. We also supplied WebSafetyNinja with our API specifications so that they can try to penetrate the APIs directly.

How many resources from the vendor's team worked with you, and what were their positions?

1 security analyst and 2 penetration testers.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

WebSafetyNinja provided us with an Executive Summary and also a detailed report. They were able to identify some issues which were resolved by our product team within a few hours.

How effective was the workflow between your team and theirs?

Communication was good, clear and timely.

What did you find most impressive or unique about this company?

We appreciated their input, attention to detail, and timely execution of their tasks.

Are there any areas for improvement or something they could have done differently?

No obvious areas for improvement.

BACKGROUND

Please describe your company and your position there.

I'm the owner of a software company.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire WebSafety Ninja?

We asked them to review our Open Source project and our cloud deployment of it in an AWS environment.

SOLUTION

How did you select this vendor and what were the deciding factors?

They found a small vulnerability on our public website. We were impressed with how they operated (they reported it to us over email, didn't push for a reward).

Describe the project in detail and walk through the stages of the project.

We gave them access to the deployed software. They did not get any special privileges as the goal was to find out whether they could escalate privilege and access files that were not supposed to be accessible.

How many resources from the vendor's team worked with you, and what were their positions?

From our perspective, we interacted with two people. A lead and someone who did the actual pentesting.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

They shared a detailed report of their findings that helped us understand the security state of our application.

How effective was the workflow between your team and theirs?

They communicated succinctly and promptly over email. Quite happy with that.

What did you find most impressive or unique about this company?

I was impressed with how transparent and straightforward they were.

Are there any areas for improvement or something they could have done differently?

I don't think there's anything that they could have done better.