What we test, and what we do not

In scope

• Domains and subdomainsEverything that resolves under your domains is where an attacker starts. We map it before we test it.
• Web applicationsYour public applications are the largest and most changeable part of the surface. They get the full OWASP baseline plus the modern attack classes.
• APIs, REST and GraphQLAPIs carry the data. Authorization mistakes between objects and between roles are the most common high-severity finding in external tests.
• Authentication flows, including OAuthLogin, password reset, session handling, tokens and single sign-on are tested as one chain, because that is how they are attacked.
• Exposed services and admin panelsManagement interfaces, databases, mail and remote access services that answer from the internet. Often forgotten, often the shortest path in.
• TLS and certificate configurationProtocol versions, cipher suites, certificate chains and hostnames, checked against current practice.
• Email security records: SPF, DKIM, DMARCNot an attack on your systems, but on your name: weak records let anyone send mail as you.
• Authenticated testing of a web applicationOptional, with test accounts you provideMost logic lives behind the login. With test accounts we can test what a customer or an employee could reach.

Out of scope

• Internal networksThey are not reachable from the internet. Testing them needs access you would have to give us, and a different authorization.
• VPN or on-site accessSame boundary. We test from the outside, through the addresses named in the agreement, and nothing else.
• Social engineeringIt targets people, not systems. That takes a different consent framework than a testing agreement for your servers.
• Phishing campaignsSame reason. We do not send mail to your staff, and our domains send no mail at all.
• Denial of serviceIt harms availability without teaching you anything about your security. No authorized external test includes it.
• Physical testingNot our trade. We test what the internet can reach.