Human-led, AI-assisted penetration testing
Between a clean scan and a breach sits the weakness nobody has proved yet. A GreySurface tester finds it, exploits it inside the rules you agree and hands your engineers the fix.
Certification names and badges belong to their issuers. GreySurface is not affiliated with or endorsed by them.
Three things every GreySurface test includes, whatever its size. Scope sets the effort and the price. It never changes these.
A finding reaches your report only when a working exploit shows what it reaches. Dead ends are closed and left out.
GET /api/invoices/10482Cookie: session=<customer B>200 OK "account": "Customer A"
Send what you run, even before the scope is settled. We reply from info@greysurface.com.
1 business day
Received FriReplied Mon
One retest of the findings we reported, within 30 days of the report.
30 days
Sample: the report, then one retest within 30 days of the report.
Automated tools are good at breadth. GreySurface works the other half: access rules, business logic and the small flaws that chain into one path in.
A tester works each lead until it holds or goes. What reaches your report carries the request and response your team can replay.
See a sample findingAI speeds up recon, triage and reporting. A tester chooses every lead worth chasing, and a person reviews every finding before it reaches you.
See who does what in a testOnce your fix is live, a tester reruns the original exploit. The record shows the response before and after, so fixed is something you can show.
See a retest recordFive steps on one sample finding at Acme Corp, a fictional client. Each step names who does the work.
We map the surface in scope and AI sorts the leads. A tester decides which are worth the time.
AI sorted the surface. A tester chose which leads to work.
A tester works each lead by hand until one holds. Dead ends never reach your report.
Same session, the next number. Nothing checks who owns the invoice.
Proved: customer B can read customer A's invoice.
We follow the exploit to the data it puts at risk. Only a working exploit makes a finding.
A person reviews the proof, the risk and the fix. Engineers get the change; leadership gets the risk.
HighOWASP API1:2023, CWE-639
Broken object level authorisation
Request
GET /api/invoices/10482 HTTP/2Host: app.acme-corp.comCookie: session=<customer B>
Response
HTTP/2 200 OK{ "id": 10482, "account": "Customer A", "amount_due": "[redacted]" }
We rerun the original exploit against your fix, so the record shows the fix holds, not only that it shipped.
The same request after your fix, as customer B
HTTP/2 200 OK{ "id": 10482, "account": "Customer A", "amount_due": "[redacted]" }
HTTP/2 404 Not FoundYour engineers replay the proof and ship the fix. Your leadership reads the risk and the briefing.
Invoices readable across customer accounts
GET /api/invoices/10482 HTTP/2Host: app.acme-corp.comCookie: session=<customer B>
HTTP/2 200 OK{ "id": 10482, "account": "Customer A", "amount_due": "[redacted]" }
In scope
Scope agreed. Your quote follows.
We test live systems by default. Testing begins only after the scope is agreed with you in writing.
Agreed scope.Written down before testing starts. Anything outside it is left alone.
Your windows.We test only inside the testing windows you agree.
One named contact.A person on your side we can reach while testing runs.
No destructive actions.We show what a flaw reaches and stop there.
Planning a release or a change freeze? Tell us in the scoping conversation and the windows are agreed around it.
Each test is led by a tester and ends the same way: proof, the business risk and a fix for every finding.
Sign-in, access control, injection, business logic
GET /w/{id}/users.csvObject and function level authorisation, and abuse
PATCH /v1/users/meLocal storage, traffic and the backend it calls
trustAllCertificatesIdentity, exposed storage and network paths
block_public_accessA goal-based attack, within agreed rules
T1078Prompt injection, data leakage, tool misuse
send_email()A full test every quarter, checks on request
Q1 Q2 Q3 Q4Tell us what you run. We will suggest where to start.
Question not listed here? Write to us with what you run and what you want to know.
Email your questionAI speeds up recon, triage and reporting. It never decides what counts as a finding. A tester does, and a person reviews every finding before it reaches you.
It depends on the scope. A single web app takes less time than a cloud account, so the timeline is agreed with the scope.
The agreed scope, the testing windows and an account for each user role you want covered.
On its scope, so there is no list price. A scoping conversation comes first, then the quote.
That the paths we tried did not work on the dates we tested. The report states what was in scope and what was not, because no test finds everything.
Question not listed here? Write to us with what you run and what you want to know.
Email your questionAligned with, never certified by. Names belong to their owners; no endorsement implied.