Quarterly red-team engagements against your live stack and applications. Findings come back as severity-mapped tickets in your tracker, with retests included after every fix. Not a static PDF and an invoice.
Four phases. The first month gets you to a baseline; the program after that keeps you ahead of it.
Stack inventory, control map, threat-model workshop. Two weeks to a documented baseline.
Quick-wins shipped immediately. Pen test runs in parallel. SOC onboarding starts.
24×7 monitoring live. Incident-response retainer active. Weekly hygiene reports.
Quarterly retests, tabletop exercises, compliance evidence rolling forward continuously.
Every capability below is delivered as part of one managed program, scoped to your business, executed by our partner network, and managed by your Katalor Security lead. One contract, one point of contact, one report.
Black-box and grey-box testing of your web applications against the OWASP Top 10. Authenticated and unauthenticated paths, business-logic abuse, chained-vulnerability scenarios. Findings ranked by exploitability, not just CVSS.
Attack-path testing across AWS, Azure and GCP. Credential abuse, IAM lateral movement, escapes from container and serverless boundaries. Models a breached engineer laptop, not just a perimeter scanner.
Internet-facing services tested as an external attacker would. Exposed admin panels, weak TLS, default credentials, forgotten dev environments. Reconnaissance through exploitation, with proof of impact.
Assumes a foothold inside the network and tests what happens next. Lateral movement, credential harvesting, domain-takeover paths. Measures blast radius before an attacker is the one doing the measuring.
Adversary-emulation engagements scoped against MITRE ATT&CK. Multi-week campaigns combining initial access, persistence, lateral movement, and exfiltration. Trains the SOC on real-world attacker behavior.
Phishing, vishing and physical pretexting against your team. Scoped, authorized, debriefed. Measures human-layer exposure and trains employees on the patterns that actually hit your industry.
In the Pulse Check, this is the web application pen test against the OWASP Top 10. Focused on your primary customer-facing app, two-week test window, findings as severity-tracked tickets. Move to the Monthly Retainer for quarterly retests and broader surface coverage.
See small-business plans →For mid-market & enterpriseIn an Assessment or Project engagement, scope expands to multi-target programs: web, mobile, API, internal network, cloud, red-team. Named senior testers, MITRE ATT&CK alignment, and a remediation plan mapped to your compliance framework. Retainers include quarterly retest cycles.
See engagement models →Schedule a 30-minute scope call with Katalor Security. We'll walk your stack, identify the top three exposures, and propose the right MSP tier. No cost.