WebSafety Ninja

BACKGROUND

Please describe your company and your position there.

I am the CTO of an Australian based SaaS RegTech solution for Education and Aged Care.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire WebSafety Ninja?

To undertake penetration testing of our web applications.

SOLUTION

How did you select WebSafety Ninja and what were the deciding factors?

They had undertaken a complimentary scan of our public websites and provided a report that allowed us to patch a vulnerability. I then had them provide a statement of work for the product penetration testing.

Describe the project in detail and walk through the stages of the project.

We provided access to a non-production version of our product platform and provided in-depth penetration testing over several days before providing a report.

How many resources from the WebSafety Ninja team worked with you, and what were their positions?

Our primary contact was Max, a Security Researcher but I understand several of the team assisted with the penetration test itself.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

The report highlighted vulnerabilities that we were quickly able to address providing a more safer and more secure solution for our customers.

How effective was the workflow between your team and theirs?

It worked very well, effective and responsive.

What did you find most impressive or unique about this company?

They provided a thorough and detailed report with recommendations that could be easily and rapidly. They acted professionally and well-mannered in the workflow.

Are there any areas for improvement or something they could have done differently?

No, it was a great service.

BACKGROUND

Please describe your company and your position there.

I am founder and Chief Product Officer at Talexio

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire WebSafety Ninja?

We commissioned WebSafetyNinja to run a number of penetration tests on our cloud based product.

SOLUTION

How did you select this vendor and what were the deciding factors?

We asked around for recommendations and we also searched online for such software providers.

Describe the project in detail and walk through the stages of the project.

We had a couple of initial meetings with the team at WebSafetyNinja. We created test accounts on the live system and also on our staging environments. We also supplied WebSafetyNinja with our API specifications so that they can try to penetrate the APIs directly.

How many resources from the vendor's team worked with you, and what were their positions?

1 security analyst and 2 penetration testers.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

WebSafetyNinja provided us with an Executive Summary and also a detailed report. They were able to identify some issues which were resolved by our product team within a few hours.

How effective was the workflow between your team and theirs?

Communication was good, clear and timely.

What did you find most impressive or unique about this company?

We appreciated their input, attention to detail, and timely execution of their tasks.

Are there any areas for improvement or something they could have done differently?

No obvious areas for improvement.

BACKGROUND

Please describe your company and your position there.

I'm the owner of a software company.

OPPORTUNITY / CHALLENGE

For what projects/services did your company hire WebSafety Ninja?

We asked them to review our Open Source project and our cloud deployment of it in an AWS environment.

SOLUTION

How did you select this vendor and what were the deciding factors?

They found a small vulnerability on our public website. We were impressed with how they operated (they reported it to us over email, didn't push for a reward).

Describe the project in detail and walk through the stages of the project.

We gave them access to the deployed software. They did not get any special privileges as the goal was to find out whether they could escalate privilege and access files that were not supposed to be accessible.

How many resources from the vendor's team worked with you, and what were their positions?

From our perspective, we interacted with two people. A lead and someone who did the actual pentesting.

RESULTS & FEEDBACK

Can you share any outcomes from the project that demonstrate progress or success?

They shared a detailed report of their findings that helped us understand the security state of our application.

How effective was the workflow between your team and theirs?

They communicated succinctly and promptly over email. Quite happy with that.

What did you find most impressive or unique about this company?

I was impressed with how transparent and straightforward they were.

Are there any areas for improvement or something they could have done differently?

I don't think there's anything that they could have done better.