A penetration testing company named for the grey zone.
The grey zone is the space between secure and breached, where a real weakness sits unproved. Our testers work there and prove what they find with a working exploit.
Why the name GreySurface?
The name comes from that space between secure and breached. The mark draws it: four chevrons, the paths an attacker takes, closing in on one grey core.
- Four chevronsThe paths an attacker takes.
- The grey coreThe zone they close in on.
Four rules every test follows. Four things we never do.
They hold for every test we run, from a single application to continuous testing.
Every test follows
- 01Human-led, AI-assistedA tester leads every test. AI speeds up the groundwork, and people make the calls.
- 02Every finding provedEach one comes with the request and the response that prove it.
- 03Risk in plain wordsWe write who could exploit each finding, how easily and what they would reach.
- 04Honest limitsWe say what was in scope and what was not. No test finds everything.
We never
- Take destructive actions on your live systems
- Send a scanner-only report
- Test outside the scope and windows you agree
- Claim to be certified by the standards our testing is aligned with
Scope and windows agreed in writing before any test starts
Where AI helps, and where people decide.
AI speeds up recon, triage and reporting. A tester picks the leads, and a person reviews every finding before it reaches you.
01Recon
A tester: Picks the leads worth working
AI: Maps and sorts the surface
02Exploit
A tester: Works each lead by hand
03Prove
A tester: Follows each exploit to what it reaches
04Report
A tester: Writes the risk and the fix
A person reviews every finding
AI: Speeds up the write-up
05Retest
A tester: Reruns the original request
Attack work shapes how we test. Defence work shapes how we report.
Our testers have blue team, red team and penetration testing experience.
We test like an attacker
We chain small weaknesses into one path, towards an agreed objective and within agreed rules.
- Sign-up formweak check
- Profile APIIDOR
- Admin panelGET /admin/users200 OKas a new account
We write like a defender
We have defended systems, so we write findings a team can act on.
FindingCritical
- What happened
- New accounts can open the admin panel
- Why it matters
- Anyone could act as an administrator
- How to fix it
- Check the role on every request
Certifications held across the testing team.
Each one is held by at least one member of the team.
Issued by OffSecOffSec Certified Professional
Issued by OffSecOffSec Web Expert
Issued by OffSecOffSec Wireless Professional
Issued by OffSecOffSec Experienced Penetration Tester
Issued by GIACGIAC Exploit Researcher and Advanced Penetration Tester
Issued by GIACGIAC Web Application Penetration Tester
Issued by INECertified Professional Penetration Tester
Issued by INEMobile Application Penetration Tester
Issued by INEWeb Application Penetration Tester
Issued by CRESTCREST Practitioner Security Analyst
Issued by Altered SecurityCertified Red Team Professional
Issued by Altered SecurityCertified Red Team Expert
Issued by MicrosoftMicrosoft Certified: Azure Security Engineer Associate
Issued by MicrosoftMicrosoft Certified: Security Operations Analyst Associate
Issued by CompTIACompTIA Security+
Issued by CompTIACompTIA Cybersecurity Analyst (CySA+)
Certification names and badges belong to their issuers. GreySurface is not affiliated with or endorsed by them.
Included with every test, whatever its size.
Scope sets the effort and the price. It does not change what you receive.
Proof for every finding
The request that proved it, the business risk and a fix.
An executive briefing
What to fix first, in words your board will use.
One retest
Of the findings we reported, within 30 days of the report.