A penetration testing company led by testers
Our testers work the weaknesses a clean scan and a passed audit leave in place, and prove each one with a working exploit.
Why the name GreySurface?
The grey zone is the space between secure and breached, where a real weakness sits unseen. We named the company after it, and the mark draws it.
Who does the penetration testing?
Our testers have blue team, red team and penetration testing experience. Attack work shapes how we test. Defence work shapes how we report.
How a GreySurface test runsWe test like an attacker
We chain small weaknesses into one path, towards an agreed objective and within agreed rules.
- Sign-up formweak check
- Profile APIIDOR
- Admin panel
We write like a defender
We have defended systems, so we write findings a team can act on.
- What happened
- New accounts can open the admin panel
- Why it matters
- Anyone could act as an administrator
- How to fix it
- Check the role on every request
Where AI helps, and where people decide
AI speeds up recon, triage and reporting. A tester picks the leads, and a person reviews every finding before it reaches you.
- Recon
A tester: Picks the leads worth working
AI: Maps and sorts the surface
- Exploit
A tester: Works each lead by hand
- Prove
A tester: Follows each exploit to what it reaches
- Report
A tester: Writes the risk and the fix
A person reviews every finding
AI: Speeds up the write-up
- Retest
A tester: Reruns the original request
Four rules for every test
They apply to a single application and to continuous testing alike. So do the four limits beside them.
What we always do
- Human-led, AI-assistedA tester leads every test. AI speeds up the groundwork, and people make the calls.
- Every finding provedEach one comes with the request and the response that prove it.
- Risk in plain wordsWe write who could exploit each finding, how easily and what they would reach.
- Honest limitsWe say what was in scope and what was not. No test finds everything.
What we will not do
- Take destructive actions on your live systems
- Send a scanner-only report
- Test outside the scope and windows you agree
- Claim to be certified by the standards our testing is aligned with
How we work with your engineers
We test in the windows you agree and work through one named contact on your side. Each finding is written so an engineer can replay it and fix it.
Sessions stay valid after sign-out
MediumReplay
GET /api/account HTTP/2Cookie: session=<signed out>- got
- HTTP/2 200
- expected
- HTTP/2 401
- fix
- End the session on the server at sign-out
Included with every test, whatever its size
Scope sets the effort and the price. It does not change what you receive.
- Proof for every findingThe request that proved it, the business risk and a fix.
- An executive briefingWhat to fix first, in words your board will use.
- One retestOf the findings we reported, within 30 days of the report.