Cybersecurity consulting
Every breach begins with a question nobody asked.
What if
Methodology
We test against published standards
Not an in-house checklist you have to take on trust. You can read every one of these yourself and check our work against it.
OWASP WSTG, ASVS and Top 10
The reference standards for web application testing and verification.
Penetration Testing Execution Standard
Covers the engagement from scoping through to reporting.
MITRE ATT&CK framework
Findings mapped to techniques attackers actually use.
NIST SP 800-115
The federal technical guide to security testing.
Certified
What we do
Four ways we work with you
Every engagement is scoped to your environment, so there is no price list here. Tell us what you have built and we will tell you what testing it properly involves.
Automated scanners find the obvious. They do not chain a weak session cookie to an authorisation gap to a full account takeover, because that takes a person who understands your business logic. We test web applications, the APIs behind them and the cloud accounts they run in, working from the same starting point an attacker has.
What you get
- Every finding rated by real business impact, not just a scanner score
- Step-by-step reproduction so your engineers can confirm it themselves
- Fix guidance written for the people who have to implement it
- A retest once the fixes are in, to prove they hold
Most organisations meet PCI DSS the hard way: a scramble before the deadline, a long list of gaps and no sense of which ones matter. We assess where you actually stand, tell you plainly what is required versus what is merely advisable, and reduce the scope you have to defend in the first place.
What you get
- Gap assessment against the current standard
- Scope reduction so fewer systems fall under the requirements
- Evidence prepared the way an assessor expects to receive it
- A remediation plan ordered by what blocks compliance first
Cloud environments grow faster than anyone documents them. A role granted for a migration two years ago is still there, still over-permissioned. We review the identity model, the network boundaries and the exposed services, and we look for the routes that turn one compromised component into access across the whole account.
What you get
- Identity and permission review across the account
- Exposed service and network boundary assessment
- Privilege escalation paths mapped end to end
- Hardening steps ordered by blast radius
Sometimes the question is not what is broken but what to do next. Which risks to accept. What to build first. How to answer a client security questionnaire honestly without losing the deal. We work alongside your team as the security voice in the room, on the decisions that are hard to reverse later.
What you get
- Security architecture review before you build
- Risk assessment framed for the people who sign off on it
- Client and regulator questionnaire support
- Direct access to your consultant, not a ticket queue
Capability
What we can test
The full range we cover. What actually runs in your engagement is whatever the agreed scope says, and nothing beyond it.
Network testing
- External perimeter
- Internal network
- Wireless
- Segmentation
- Firewall and intrusion detection
Web application testing
- Application programming interfaces
- Authentication and authorisation
- Input validation
- Session management
- Business logic
Mobile application testing
- Android and iOS
- Static and dynamic analysis
- Reverse engineering
- Data storage
- Cryptography
Cloud infrastructure testing
- AWS, Azure and Google Cloud
- Infrastructure as code
- Identity and access management
- Container security
- Serverless and data storage
Source code review
- Static analysis of your codebase
- Data and control flow
- Dependency and library review
- Hardcoded credentials
- Build pipeline integration
Continuous scanning
- Web, API and single-page apps
- Authenticated scanning
- Assessor-validated results
- False positives removed
- Consistent severity ratings
How an engagement runs
You always know where things stand
Every phase has a clear start, a clear end and something you receive. No stretch of silence where you are paying for work you cannot see.
We measure the engagement by what you have closed, not by how many findings we opened.
- Phase 1
Scoping and rules of engagement
We agree in writing what is in scope, when testing happens, and what is off limits. Nothing starts until someone empowered to authorise it has signed.
- Phase 2
Planning and preparation
You supply target lists, test credentials and environment access. We confirm every authorisation document is signed before a single packet is sent.
- Phase 3
Execution
Testing runs against the agreed scope, with progress updates at the interval you choose. Anything critical reaches you immediately, not at the end.
- Phase 4
Validation and retest
We walk the findings through with your team, evidence in hand, and retest once fixes land. Test artefacts are cleaned up together before we close.
- Phase 5
Report and debrief
A written report plus a walkthrough with your stakeholders: what we found, what it means for the business, and what to fix first.
Scoring
Severity is not our opinion
Findings are scored with the Common Vulnerability Scoring System version 4.0, the published standard maintained by FIRST, the Forum of Incident Response and Security Teams. You can check any rating we give against it.
Where a finding cannot be meaningfully scored, such as a governance or architectural weakness, we say so and give a reasoned rating instead of forcing a number.
Boundaries
What we will not do without asking
These are out of scope by default. We will only undertake any of them where you have specifically requested it and authorised it in writing.
- Denial of service, load and stress testing
- Social engineering, phishing and pretexting
- Physical security and intrusion testing
- Red team exercises and detection evasion
- Traffic interception and man-in-the-middle positioning
- Large-scale password guessing against production
The name
Waif is short for what if.
Every incident we have ever been called in to examine started as a possibility somebody did not consider. Not a sophisticated zero-day. A permission granted for a migration and never revoked. A test account that outlived the test. An assumption that the internal network was internal.
The work is asking those questions early, on purpose, while it is still cheap to answer them. That is the whole discipline, and it is why the question mark sits inside our name.
Ask what if today, and you are far less likely to be asking what happened tomorrow.
Sample report
See exactly what you would receive
Judging a security firm before you hire one is difficult. So here is a full redacted penetration test report - the real deliverable from a real engagement, with the client details removed.
- An executive summary a non-technical board member can act on
- Every finding rated by business impact, with full reproduction steps
- The attack narrative, showing how small issues chain into a breach
- A remediation roadmap ordered by what to fix first
Get in touch
Tell us what you have built
A short description is enough to start. We will come back with what testing it properly involves, what it would cost and when we could begin.
Prefer email? [email protected]