Skip to content
LorienSoft

Security testing andcompliance support.

Penetration testing, application security review and the compliance work enterprise buyers ask for. Findings come prioritised and reproducible, each with a recommended fix.

Start a project →All services

What a security engagement produces.

  1. 01

    Penetration testing

    Web, API, mobile and cloud tests against an agreed scope and rules of engagement, with reproducible findings and risk ratings.

  2. 02

    Application security review

    Code and architecture review against the OWASP Top 10 and ASVS, covering authentication, authorisation, input handling and secrets.

  3. 03

    Threat modelling

    Structured sessions with your engineers that find design flaws before they are built, recorded as decisions to keep or to fix.

  4. 04

    Cloud and infrastructure hardening

    Review of IAM, networking, storage and CI/CD against CIS benchmarks, delivered as infrastructure-as-code changes where possible.

  5. 05

    GDPR readiness

    Data inventory, lawful-basis mapping, retention rules, processor agreements and the technical controls that support them.

  6. 06

    Compliance evidence

    Policies, access reviews, logging and change-management evidence prepared for customer questionnaires and for ISO 27001 or SOC 2 audits.

Pre-launch tests, questionnaires and data-protection work.

  • A pre-launch penetration test for a customer-facing portal

    A time-boxed test of the application and API before go-live, with a retest of the fixes and a summary that your customers’ security teams can read.

  • Answering an enterprise security questionnaire

    Review the questions, map them to your real controls, close the gaps that are cheap to close and document the rest.

  • GDPR alignment for a growing product

    Inventory personal-data flows, set retention and deletion rules, and implement consent, access and erasure requests in the product itself.

From agreed scope to retest letter.

  1. 01

    Define scope and rules

    Assets, environments, test windows and escalation contacts are agreed in writing before any testing begins.

    You get
    Scope and rules of engagement

  2. 02

    Test and review

    Manual testing guided by threat models and supported by tooling, plus code review where source access is granted.

    You get
    Working notes shared as we go

  3. 03

    Report, with fixes

    Each finding carries a severity, reproduction steps, impact and a recommended fix. Critical issues are reported as soon as we find them.

    You get
    Findings report and executive summary

  4. 04

    Retest and confirm

    We verify your fixes and issue a retest letter that you can share with customers and auditors.

    You get
    Retest report and letter

Standards and tooling.

Manual testing leads and the tools support it. The frameworks listed are the ones we prepare evidence for.

Standards

  • OWASP Top 10
  • OWASP ASVS
  • CIS Benchmarks
  • NIST CSF

Testing

  • Burp Suite
  • OWASP ZAP
  • Nuclei
  • MobSF

Pipeline

  • Semgrep
  • Trivy
  • gitleaks
  • Dependabot

Cloud

  • Prowler
  • ScoutSuite
  • AWS Security Hub
  • Terraform

Frameworks

  • ISO 27001
  • SOC 2
  • GDPR
  • UK GDPR

Related reference builds.

View all work →

Production testing, certification and legal advice.

Only when you ask us to, and with controls agreed in advance. Normally we test a staging environment with production-like data shapes, so that nothing real is at risk.

Other services