// Services.jsx — VAPT taxonomy: 6 service lines mirroring the offering map const SERVICES = [ { icon: 'shield', tag: 'Full-scope', slug: 'vapt', title: 'Penetration Testing', desc: 'Manual testing across web, API, network, and identity in one engagement. The best starting point for most teams.', approach: 'We map your attack surface, then test it by hand, combining smaller findings into the path an attacker would take to your data. You get proof of what was possible, with every step documented.', items: [ 'External & internal network exploitation', 'Web, API, and authentication attack chains', 'Active Directory and privilege escalation', 'Manual business-logic and access-control abuse', 'CVSS + business-impact scoring on every finding', ], standards: ['NIST SP 800-115', 'PTES', 'OSSTMM v3'], typicalFindings: '3–7 high · 1–3 critical · exploit chains in 8 of 10 engagements', bestFor: 'Annual compliance cycles, pre-launch assurance, board-mandated assessments, first-time pentests.', }, { icon: 'globe', tag: 'Web App', slug: 'web', title: 'Web Application Pentesting', desc: 'Manual testing of your web application, logged in and logged out. We cover the OWASP Top 10 and go further into business logic and access control.', approach: 'We map every role in your application and test the trust between them. That is where the serious issues live: a low-severity access-control bug that turns into cross-tenant data exposure.', items: [ 'Auth, session, and access-control flaws', 'Server-side injection (SQLi, SSTI, SSRF, XXE)', 'Business-logic abuse and privilege escalation', 'Client-side exploitation (XSS, CSRF, prototype pollution)', 'Race conditions and HTTP request smuggling', ], standards: ['OWASP ASVS L2/L3', 'OWASP WSTG', 'OWASP API'], typicalFindings: '3–7 high · 1–3 critical · IDOR or SSRF chains in 8 of 10 engagements', bestFor: 'Pre-launch, SOC 2 / PCI cycles, post-refactor surfaces, multi-tenant SaaS.', }, { icon: 'fingerprint', tag: 'Mobile', slug: 'mobile', title: 'Mobile Application Pentesting', desc: 'iOS and Android tested against OWASP MASVS: on-device storage, transport, runtime, and the backend API that serves them.', approach: 'We test on real devices, jailbroken and stock, and include the backend API in the same engagement. The app, the connection, and the server are one attack surface, so we test them together.', items: [ 'Static and dynamic binary analysis', 'Insecure storage and keychain abuse', 'Cert pinning, jailbreak / root detection bypass', 'Frida, Objection, and runtime hooking', 'Backend API surface attached to the app', ], standards: ['OWASP MASVS L1/L2', 'MSTG', 'App Store policy'], typicalFindings: 'Storage and pinning bypass in 9 of 10 engagements · biometric bypass in about 40%', bestFor: 'New app launches, store-review prep, banking / regulated apps, biometric flows.', }, { icon: 'cloud', tag: 'Cloud', slug: 'cloud', title: 'Cloud Pentesting', desc: 'AWS, Azure, GCP, and Kubernetes. We start with your identity and access setup, then show the path from a low-privilege user to your most sensitive data.', approach: 'Most cloud breaches start with a permissions mistake. We map every role and trust relationship first, then demonstrate the attack chains that posture tools score as low risk.', items: [ 'IAM and identity-graph abuse paths', 'Privilege escalation through service roles', 'Container, EKS / AKS / GKE breakouts', 'Storage exposure (S3, Blob, GCS)', 'CI/CD pipeline and secret-store hardening', ], standards: ['CIS Benchmarks', 'CSA CCM', 'CIS K8s'], typicalFindings: '80%+ of cloud incidents start in IAM · 4–8 trust-chain findings per environment', bestFor: 'Multi-account organizations, post-IPO security debt, Kubernetes migrations, regulated cloud workloads.', }, { icon: 'refresh', tag: 'Continuous', slug: 'ptaas', title: 'Continuous Pentesting', desc: 'Testing that keeps pace with your releases. One of our testers reviews every meaningful deploy, and findings reach your backlog as soon as they are confirmed.', approach: 'Every code change can introduce new risk. We test your surface continuously, confirm findings as they appear, and verify your fixes within days, all in one dashboard with one accountable contact.', items: [ 'Release-triggered manual retesting', 'Live findings dashboard with SLAs', 'Free retests for the life of the contract', 'Jira, Linear, and GitHub ticket sync', 'Quarterly attestation letters for compliance', ], standards: ['PTES', 'OWASP', 'SOC 2 continuous'], typicalFindings: 'Median fix-to-verify under 48 hours · regressions caught in about 30% of cycles', bestFor: 'High-velocity engineering teams, SaaS on weekly releases, continuous-compliance programs.', }, { icon: 'target', tag: 'Red Team', slug: 'red-team', title: 'Red Teaming', desc: 'Full-scope adversary simulation with a real objective. We test how well your people, processes, and tools detect and respond to a determined attacker.', approach: 'Every campaign is built for your organization, from the pretext to the infrastructure. We combine email, phone, physical, and network routes toward one objective, then sit down with your defenders and turn what we did into detections.', items: [ 'Spear-phishing and pretexting campaigns', 'Vishing and smishing operations', 'Physical access and tailgating exercises', 'Full-scope objective pursuit with custom C2', 'Joint exercises with your defenders', ], standards: ['MITRE ATT&CK', 'TIBER-EU', 'CBEST / iCAST'], typicalFindings: 'Average phish click rate 34% · MFA-fatigue success in 6 of 10 organizations · physical access in 75%', bestFor: 'Detection-engineering uplift, board-mandated TIBER or CBEST exercises, post-incident validation.', }, ]; const Services = () => { const [active, setActive] = React.useState(0); return (

What we test

Penetration testing services

Every engagement is led by an experienced tester. You get reproducible proofs of concept, a clear picture of the business impact, and free retesting within 90 days.

{SERVICES.map((s, i) => ( setActive(i)} /> ))}
); }; const ServiceFeature = ({ s }) => (
{s.tag}

{s.title}

{s.desc}

{/* Approach — plain prose, no box */}

{s.approach}

{/* Capability list */}
Capabilities
{s.items.map(item => (
{item}
))}
Aligned to {s.standards.map(t => ( {t} ))}
e.currentTarget.style.background = '#828fff'} onMouseLeave={e => e.currentTarget.style.background = '#5e6ad2'} > Explore the service { e.currentTarget.style.borderColor = '#34343a'; e.currentTarget.style.background = '#141516'; }} onMouseLeave={e => { e.currentTarget.style.borderColor = '#23252a'; e.currentTarget.style.background = 'transparent'; }} > Get a quote
); const ServicePill = ({ s, active, onClick }) => ( ); Object.assign(window, { Services, ServiceFeature, ServicePill });