Security review of source code, open-source dependencies, SBOMs and CI/CD pipelines, measured against NIST SSDF, SLSA and the OWASP CI/CD risks.
Manual, tool-assisted review of application source code for vulnerabilities, focused on authentication, authorization, input handling and cryptography; how it complements a penetration test, what languages and access are needed, and how findings are reported.
Producing or checking an SBOM in CycloneDX or SPDX format, reviewing open-source dependencies for known vulnerabilities, maintenance health and license issues, and setting up a process to keep the inventory current.
Review of build and deployment pipelines against the OWASP Top 10 CI/CD Security Risks and SLSA build levels: pipeline permissions, secrets, runner isolation, third-party actions and artifact integrity.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.