Network, servers, cloud, IAM, secrets, backups. Where outsiders enter and what to harden first — a roadmap, not a CVE dump.
The app can hold up while the infra doesn’t: open SSH, weak cloud roles, shared keys, a flat network. Half of incidents start in config and access, not in application code. Without an assessment you patch at random and learn about the hole after the breach.
In this engagement:
Surface scan plus hands-on review of critical nodes, plus a short interview with whoever runs the infra. We map findings to how you ship, grant access, and handle backups. Deliverable: a prioritized roadmap with clear “why” — not an 80-page report for bulk. Scope and timeline are locked after a short contour review.
It depends on the contour: one cloud product vs. a server fleet with vendors are different scopes. Typically we need a window for scanning, hands-on review, and a call with your admins. You get findings tied to business risk and a roadmap: fix now, plan next, or accept. Timeline and format are fixed after a short look at perimeter and access.
A scanner won’t tell you the admin panel is on 0.0.0.0, one key is shared by three vendors, or backups were never restored. App pen-tests look at the product; infra looks at what the product runs on: IAM, network, secrets, segmentation, cloud roles. You harden the code and still leave the contour open. We tie findings to how access and operations actually work — not a CVE pile with no priority.