//Methodology
Machines scan.
People think.
Most testing fails in one of two directions. Traditional firms bill senior engineering rates for hours spent running scanners and formatting their output. Automated platforms produce a long, cheap list of isolated technical issues with no idea which of them lets somebody move money.
We split the work along the line where each is genuinely better.
01Division of labour
Who does what, and why.
Nothing on the left requires judgement. Nothing on the right is visible to a tool that does not know what your business does.
| Dimension | Automation layer | Senior engineer |
|---|---|---|
| Scope | Asset and subdomain discovery, port and service enumeration, signature scanning, known-CVE checks, initial parameter fuzzing. | Business logic, authorisation boundaries, privilege escalation, cross-system attack chaining. |
| Speed & scale | Wide, fast, and repeatable across the entire external surface. | Deliberate and narrow, aimed at the assets and workflows that actually matter to you. |
| Context | None. Every endpoint is a generic technical target. | Understands settlement, approval hierarchies, tenant boundaries and what a bad day costs you. |
| Exploitation | Verifies a single vulnerability. Pattern matching. | Chains three findings nobody rated above Low into an unauthorised transfer. |
| Reporting | Telemetry, deduplication, evidence capture, first-pass drafting. | Risk prioritisation, remediation strategy, and the narrative your board will actually read. |
No finding reaches you without a human confirming it. Automated output is treated as a lead, never as a result. Anything we cannot reproduce and demonstrate does not go in the report — which is why you will not receive a two-hundred-page appendix of theoretical issues to triage yourself.
02The engagement
Three phases.
The second phase is the one most firms skip, and it is the reason the third phase finds anything worth paying for.
- 01
Outsider recon
Map what an unauthenticated attacker sees before they have any help from you.
Automation
Agents enumerate subdomains and exposed services, cross-reference live CVE data, and run non-disruptive parameter fuzzing. Days of standard reconnaissance compress into hours.
Engineer
Engineers read the output as it lands — discarding noise and flagging the things a scanner cannot interpret: non-standard API surfaces, unusual authentication flows, hosts that should not exist.
- 02
Context alignment
Stop enumerating technology and start modelling business risk.
Automation
Findings are deduplicated and ranked so the session starts from evidence rather than a blank page.
Engineer
We sit down with your technical and business people and ask the questions that decide where the rest of the engagement goes: which workflows stop the company if they break, how authorisation is *supposed* to behave, and where legacy systems meet modern infrastructure.
- 03
Deep-context exploitation
Weaponise that context against the gap between design and reality.
Automation
Assists with target-specific payload generation, custom tooling, and post-exploitation evidence capture — the mechanical parts of exploitation.
Engineer
Engineers attack the difference between how the software was designed and how the business actually runs. This is where the findings that justify the engagement come from.
03Phase 02
What we ask you.
- “Which flow, if abused, moves money out without a second person seeing it?”
- “How are tenant and account boundaries *supposed* to behave on a transfer?”
- “Where does the ledger trust an upstream system to have already checked?”
- “Which of these would you least like to explain to your regulator?”
04What this buys you
The same endpoint, read two ways.
What a scanner reports
POST /api/v2/transfers/approve
HTTP/1.1 200 OK
→ No issue detected.
Endpoint authenticated.
TLS valid. Headers present.The request succeeded, the session was valid, and nothing matched a known signature. There is nothing here for a tool to flag, and it is correct not to flag it.
What an engineer sees
POST /api/v2/transfers/approve
tenant_id=101 → 102
HTTP/1.1 200 OK
→ Approval succeeded across a
tenant boundary.Because phase two established that approvals are meant to require a second person within the same tenant, that 200 is a user authorising their own corporate wire transfer. Critical, unfindable by signature, and worth more than the rest of the report combined.
05Straight answers
What automation touches.
Your procurement team will ask. The answers are here in advance, and they go into the engagement contract rather than staying on a marketing page.
- Your data is not training anything
- Nothing from your environment is used to train, fine-tune or improve any model, ours or a third party’s. This is a contractual term, not a preference.
- Findings are human-validated
- Automated output is a lead. A human reproduces and demonstrates every finding before it reaches your report, which is why there is no false-positive appendix.
- Scope is enforced by people
- Automation runs only against assets named in the written authorisation. Targets are set and reviewed by an engineer — never expanded automatically because something looked related.
- Nothing destructive runs unattended
- Discovery and enumeration are automated. Exploitation is performed by a human who can see what is happening and stop.
- You can opt out entirely
- If your policy or regulator does not permit third-party automation against your estate, we will run the engagement fully manually and price it accordingly. You will get the same report; it will take longer and cost more.
→Next step
See it run against your own estate.
The reconnaissance briefing is phase one, delivered at no cost against your real perimeter. It is the least abstract way to judge whether any of this holds up.
daniel@theosec.com · +27 63 484 1051