Before we begin testing, BreachLock™ along with your company will determine the full scope that will be tested. Clear and open discussion with the customer is integral at this step. All communication is facilitated via our SaaS portal which enforces our methodical approach and promotes collaboration between teams. At this stage, we determine the companies’ infrastructure such as domains, servers, and other devices with IP addresses. We then determine if any should be excluded and why. Once we have a list of all of the devices to be tested we can then define the testing duration.

We begin to attack vulnerabilities and known weak spots with your web application. We perform this step with the utmost care in order to protect both the web app and your data. We repeat the penetration process using both manual processes and automated tools. We use many methods such as those prescribed in OWASP methodology. Utilizing our SaaS, we are able to scan your systems in order to find the vulnerabilities that are putting your data at risk. The results of this phase are recorded in PDF and online reports that are made available to you within our SaaS portal.

The BreachLock™ team collects and compiles all of the obtained information and provides the customer with an exhaustive report. We also include comprehensive recommendations to aid business leaders as well as the IT team in order to make logical decisions regarding web application security. We provide a list of each vulnerability, including how we tested and how we recommend resolving the risk. At this stage, we provide specific technical details using which the IT team can act quickly. Our online ticketing system can be used to ask any questions to BreachLock™ security researchers.

After both the business leaders and the IT team are able to read the report and act during the remediation process, we will retest to determine the effectiveness of findings resolution. We will rerun our penetration test on the web application. As a result of the retest, you can download an updated report from within our SaaS portal. This report will either show a clean build or a patched vs not patched status for each finding. If all vulnerabilities are solved we will also issue you a security certificate valid for 12 months.