Northwall performs external security assessments for small software teams. We look at a product the way an outsider would, and return a short report: what we found, what it means, and what to fix. Every item in that report has been verified by hand.
Three principles. None of them is negotiable.
Automated collection is only the starting point. Each result is opened, checked against the code or the response, and confirmed by hand before it reaches the report. Nothing moves from a scanner feed into a document we sign.
Every finding ships with the request or command that produced it, and the output. You can run it yourself. If we cannot reproduce it, it does not go into the report, however plausible it looks.
Reports contain only confirmed findings, usually a dozen or fewer. High-severity items are limited to three and ordered by whether they can be exploited now, not by the severity label assigned to them.
Coverage is easy to claim and difficult to verify. What matters is whether each finding holds up when a customer questions it.
Eight areas, 32 checks, all performed from outside. No credentials are needed.
Three documents.
One page: scope, the number of findings, and the remediation deadline. It can be forwarded without explanation.
Five pages, in the language of the engagement. All 32 checks are listed, including the ones that passed, so the document shows what was examined and not only what was wrong.
The output and screenshots behind each finding, plus a script that reproduces them. When someone asks how we know, this is what we send.
Most assessments begin because a customer asked for one.
A customer sends two hundred questions and needs answers with evidence behind them.
Due diligence asks about security. Answers written the week before are usually not enough.
Finding an exposed database before a customer does is cheaper than finding it afterwards.
Keys, proxy authentication and tool permissions are newer forms of exposure, and often missed.
Two ways to work with us.
A single assessment, for teams that need a report now.
For teams that are asked regularly, and need the evidence to stay current.
Annual billing is $2,999 instead of $3,596 — a saving of $597. Remediation work is quoted separately.
Send a domain. We reply with a scope and a testing window.
Work starts once the scope is agreed in writing. Anything outside it is not tested.
Automated collection, then manual review. Anything we cannot reproduce is not reported.
The report within 48 hours, a walkthrough, and one recheck.
A scanner returns hundreds of results and leaves the judgement to you. We report only what we confirmed, usually about a dozen items. The difference is not coverage but accountability: the report is signed, and every finding can be reproduced.
No. Every check is performed from outside, against what an attacker can reach. If you want a review that includes internal systems, that is a different engagement and we will say so.
Two working days from the moment the scope is agreed. Delivery is within 48 hours of starting.
No. We do not provide certification. We establish where you are actually exposed, before you spend money on an audit. Auditors want process documentation; we provide technical facts. The two do not conflict, but they do not replace one another.
No, and no assessment can. Any assessment is a sample. What we guarantee is that every finding has been verified and can be reproduced. What we could not check is marked as not covered, never as passed.
Then the report says so, and lists what was examined. A short report with nothing in it is still a document you can put in front of a customer.
Northwall is an independent security studio. Every assessment is carried out by the people who sign the report; nothing is subcontracted.
We do not sell security products and represent no vendor. The only thing we sell is the assessment itself.
We work in English and Chinese, mostly with teams of five to fifty people.
Send a domain and we will tell you whether an assessment makes sense, and what it would cover.