Skip to content
AUSEC
Esc
  • Home/
  • Services/services/
  • Penetration testing/services/penetration-testing/
  • Vulnerability assessment/services/vulnerability-assessment/
  • Security audit/services/security-audit/
  • Compliance consulting/services/compliance-consulting/
  • Incident response and digital forensics/services/digital-forensics/
  • Corporate training and workshops/services/corporate-training/
  • Audit methodology/methodology/
  • Security posture quiz/#quiz
  • Threat Lab: attack simulator/threat-lab/#simulator
  • Threat Lab: cyber kill chain/threat-lab/#kill-chain
  • Threat Lab: defence in depth/threat-lab/#defence
  • Threat Lab: spot the phish/threat-lab/#phish
  • Threat Lab: terminal/threat-lab/#terminal
  • Frameworks hub/frameworks/
  • Framework cross-mapping/frameworks/#crossmap
  • PCI DSS v4.0.1/frameworks/pci-dss/
  • ISO/IEC 27001:2022/frameworks/iso-27001/
  • ISO/IEC 27002:2022/frameworks/iso-27002/
  • NIST Cybersecurity Framework 2.0/frameworks/nist-csf/
  • CERT-In Audit Guidelines (India)/frameworks/cert-in/
  • Training and internships/training/
  • Resources: articles and checklists/resources/
  • PCI DSS v4.0.1: what changed, and what it means now/resources/pci-dss-4-0-1-changes/
  • ISO/IEC 27001:2022 Annex A for beginners/resources/iso-27001-annex-a-beginners/
  • NIST CSF 2.0: the Govern function explained/resources/nist-csf-govern-function/
  • How to prepare for a CERT-In audit/resources/prepare-cert-in-audit/
  • Glossary/resources/#glossary
  • Team and certifications/team/
  • About Ausec/about/
  • Contact and book an assessment/contact/
  • Privacy policy/privacy/
  • Terms of use/terms/
  • Responsible disclosure/responsible-disclosure/
  • Design system/styleguide/

How an engagement runs

The same disciplined sequence whether it is a penetration test, a security audit or a compliance programme. Methodologies are aligned to OWASP, PTES and the standard you need to meet.

Six steps

  1. 1

    Scope and discover

    We agree what is in scope and map every exposed asset. Nothing is tested without written approval.

  2. 2

    Assess

    Configuration, architecture and policy are reviewed against the standard that matters to you.

  3. 3

    Exploit safely

    Testers prove which weaknesses are real by exploiting them in an agreed, controlled way.

  4. 4

    Harden

    Each finding comes with a plain fix. We work with your team on the order to close them.

  5. 5

    Monitor

    We check that logging and alerting would catch the attacks we just ran.

  6. 6

    Verify and report

    We re-test the fixes and hand over a report you can share with auditors and customers.

Rules of engagement

Written authorisation
Scope, targets, test windows and contacts are signed off before any testing starts.
Safe by default
Exploitation proves impact without destroying data or disrupting production. Risky tests are agreed first.
Escalation path
Critical findings are reported to your named contact immediately, not saved for the report.
Data handling
Evidence is kept to the minimum needed, stored securely and returned or deleted after the engagement.

What you receive

Executive summary
Business risk in plain language for leadership and the board.
Technical findings
Evidence, CVSS rating, affected assets and reproduction steps for each issue.
Remediation road map
Fixes ordered by risk and effort, mapped to the standards you report against.
Re-test report
Confirmation of which findings are closed, ready to share with auditors and customers.

sample-report.pdf

Redacted example
  1. 01Executive summary
  2. 02Scope and methodology
  3. 03Findings by severity
  4. 04Evidence
  5. 05Remediation road map
  6. 06Re-test results
  7. 07Appendix: standards mapping
FINDING 04HIGH
Asset
.
Issue
Default credentials on admin console
Evidence
CVSS
8.8
Fix
Change and vault the password; restrict console to the admin network
Status
Re-tested: closed
Illustrative example of a report outline and a finding. Not from a real client.

Ready to scope an engagement?

Book a Security Assessment