Human-led penetration testing, retested until every finding is fixed.
Our testers attack your web apps and APIs the way a real adversary would. Every finding is reproduced before you see it, lands in a console your engineers work from, and stays open until we have retested the fix.
Your pentestertesting live- covers
Web apps, REST and GraphQL APIs, cloud-hosted assets
- finds
Broken access control, injection, auth flaws, business-logic abuse
- you get
A live findings console, CVSS scoring, retests and an audit-ready report
Six steps from scoping to a signed-off report.
This is the order things happen in the product, and who does each part. The examples use a fictional clinic, Larkspur Health.
Tell us what to test.
Onboarding captures each target's name, URL, environment and tech stack. Testers read that before sending a single request.
Your engineer fills it inAgree the limits before anything runs.
You set the testing window and an emergency stop phrase. Say it and all active testing halts. No denial-of-service, no destructive exploits, nothing outside the listed targets.
Signed off with our compliance leadPeople first, scanners second.
Automated scans cover breadth. A tester then works through recon, discovery, non-destructive exploitation and privilege escalation, following the OWASP Testing Guide and NIST SP 800-115.
Your pentesterFindings are reviewed, then released.
Each finding is reproduced and written up before you see it, so nobody chases a false positive. Anything at CVSS 8.0 or higher is released and flagged immediately.
Your pentesterYour team fixes it. We confirm it's fixed.
Engineers move findings to In Progress, Patched or Accept Risk. Patched findings are retested before they count as Resolved, and each target's health score climbs as they close.
Our retest analystA report an auditor will accept.
When the engagement closes you get an executive summary, a technical write-up with CVSS scores, and a prioritised remediation roadmap, within five business days.
Ready for your auditor- Listed targets only, inside the window
- No denial-of-service unless approved
- No changes to your data
Any signed-in user can read and edit another organization's invoices by changing the ID in /v2/invoices/{id}.
- Reviewed by a second tester at 10:48
- Alert sent because CVSS ≥ 8.0
You set the first three. Our retest analyst sets Resolved once the retest passes.
Accept Risk records your decision and keeps the finding on the report.
health = 100 − 20C − 10H − 5M − 2L
Larkspur Health
October 2026
This is what your engineers log into.
Filter by severity, open a finding, change its status and run a retest. Health scores use the same formula as the real product.
NyxShield Dashboard
Larkspur Health · security overview
| Vulnerability | CWE | CVSS | Status |
|---|
What we commit to before you sign anything.
These terms come from the rules-of-engagement document every NyxShield client signs.
From finished onboarding to first test traffic.
Reported the moment it's confirmed, not saved for the final report.
From the end of testing to the final report.
Nothing destructive.
No denial-of-service, no exploits that risk data loss or downtime, no changes to your data.
We stop when you say.
On your stop phrase, on any sign of instability, or if we spot a real attack in progress.
Evidence, credentials and logs are encrypted and securely deleted within 30 days.
Ready to see what an attacker would?
No payment, no commitment. We quote your exact scope before pricing goes public.