Security testing
Vulnerability assessment
A vulnerability assessment is broader but shallower than a penetration test: it maps what you expose and which known weaknesses affect it, and ranks the risks. It's a good first step when you don't know where you stand.
Quoted individually, based on the scope.
What's included
- Inventory of exposed applications, domains and services.
- Automated scanning, with every result checked by hand to remove false positives.
- Outdated software and known vulnerabilities in dependencies.
- Security configuration: headers, TLS, exposed panels and default settings.
What you get
- A list of risks ranked by CVSS v4.0 severity, each explained in plain language.
- Concrete fixes for each one.
- A recommendation on whether a deeper penetration test makes sense.
Who it's for
- Companies that have never assessed their security.
- Small teams without a security specialist.
- Companies that want a regular check-up between penetration tests.
Not included
- Exploiting the vulnerabilities found (that's a penetration test).
- Scanning systems without written authorization from their owner.
Process
How I work
-
Scope and authorization
We define what to test, how and when. Nothing starts without your written authorization.
-
Testing
Manual testing and review, supported by tools. If I find something critical, I tell you right away.
-
Report
You get every finding rated with CVSS v4.0, with the steps to reproduce it and the recommended fix.
-
Follow-up
I walk your team through the results and answer questions while you apply the fixes.
Frequently asked questions
How is this different from a penetration test?
The assessment finds and ranks known weaknesses across everything you expose. The penetration test goes deeper on a defined target and shows what an attacker could actually achieve.
Other services
- Web and API penetration testing Manual testing of web applications and APIs, the way an attacker would approach them.
- Cloud penetration testing (AWS) Testing and configuration review of AWS environments: permissions, exposure and secrets.
- Mobile penetration testing Security testing of Android and iOS apps and the APIs behind them.
- Secure code review A review of your code to find vulnerabilities before they reach production.
Have a system to test or review? Send me the scope
Tell me what you need tested (applications, APIs or environments), by when, and any constraints, and I'll reply with the next steps. I work in English and Spanish.
hello@santiagopassafiume.comLooking for development? Websites, applications and backend projects go through RyuLabs.