- Development teams that need automated recurring checks
- For teams looking to automate recurring manual checks, from login to feature access.
- Development teams managing library vulnerabilities
- When the actual impact of identified library vulnerabilities and remediation priorities need to be determined.
- Organisations that need deployment security criteria
- When you need to establish security checks and remediation criteria for development and deployment pipelines.
Secure development &
vulnerability management
We integrate security testing that reflects your service’s authentication flows
and library vulnerability management into your development and deployment environment.
Who we work with
Implementation and operational handover
- Current-state analysis and improvement priorities
- We recommend the required setup and implementation sequence based on your existing tools and development environment.
- Automation setup and operational documentation
- We hand over the agreed test and pipeline configurations, together with instructions for execution, reviewing results and handling errors.
- Vulnerability handling criteria and handover
- We document the basis for impact assessments and exceptions, along with fix verification procedures, and explain them to the developers responsible.
Detailed scope of collaboration
We establish procedures that fit into real development workflows, from tool adoption to execution, result review and remediation.
- Automating authenticated security testing
- We design assessment flows for services that require login and integrate repeatable tests into development and deployment procedures.
- Dependency identification and impact analysis
- We create a software bill of materials (SBOM) and assess the actual impact of known vulnerabilities. Where needed, we document the basis for our conclusions using VEX.
- Fix verification and operational handover
- We configure tests to recheck remediated vulnerabilities and document the responsible team’s result review and response procedures.
Project information
- Preparation
- We review your technical architecture, CI/CD and repository environments, existing security tools and the people responsible.
- Scope, schedule and quotation
- We agree on the services and pipelines to connect and the implementation tasks. If new tools are needed, we also review their terms of use and costs.
- Change and access permissions
- We agree on the required access permissions and test environment. Settings that affect development, such as deployment blocking, are agreed with the responsible team before implementation.
- Completion criteria
- We agree on completion criteria such as automated execution, result review and error handling before work begins, and verify them together at handover.
- Follow-up verification
- The scope for verifying the implementation and the terms of support after handover are specified in the contract. Separate penetration testing or ongoing operation is agreed according to the required scope.