Security assessment standards and process
From scope agreement to vulnerability verification, reporting and retesting.
We document the evidence and judgements at every stage.
The four stages of assessment
Explore the report- 01
Confirming the assessment scope
We identify the service’s purpose and key assets, then agree on testing scope, schedule and stopping criteria.
- 02
Vulnerability verification
We design attack scenarios around user roles and data flows, and verify reproducibility and impact.
- 03
Reporting and remediation recommendations
Management receives risk assessments and remediation priorities, while development teams receive reproduction evidence and specific recommendations.
- 04
Retesting after remediation
Within the agreed scope, we retest under the same attack conditions and document remediation results and residual risk.
For web applications and APIs, we use OWASP WSTG, and for AI, OWASP AITG as our testing references. Before work begins, we agree on the applicable Korean standards and retesting scope for ISMS-P assessment preparation, data protection and sector-specific security requirements.
Assessing security boundaries
Across the boundaries of inputs, permissions and data,
we identify vulnerable points and their impact.
Key assessment areasAssessment methods for AI, APIs and login sessions
We test whether instructions in external documents
can manipulate the AI’s behaviour.
We test whether instructions embedded in documents override system rules, and whether this leads to unauthorised information access or tool execution.
Security assessment report
An anonymised Korean-language extract from an actual report.
Omitted content is marked with ‘…중략…’.
Preview key report pages
Executive summary and detailed technical analysis pages, with customer information anonymised.
