The consultant who scopes your test leads it and signs the report.
No hand-offs to junior staff and no scanner output dressed up as findings. You talk to the person doing the work, from the first call to the retest.
What You Get From Us
Four commitments that hold on every engagement
Senior-led, start to finish
The consultant on your scoping call leads your test and writes your report. You get a direct line for questions during remediation.
Every finding proven
We never report scanner output as findings. Each issue comes with a working proof of concept, the evidence, and the impact in business terms.
Free retest and written sign-off
We retest every fixed finding free for 90 days, then sign off remediation in a letter your auditors and customers can rely on.
Fixed price, agreed up front
A 20-minute scoping call gets you a fixed-price quote. The number doesn't move once testing starts.
Scan vs. Penetration Test
What changes when a person does the testing
| Automated vulnerability scan | Nomad Security penetration test | |
|---|---|---|
| Finds known CVEs and misconfigurations | Yes | Yes, as a starting point |
| Finds broken authorization and business-logic flaws | Rarely | Yes, this is where most of the time goes |
| Chains issues into a real attack path | No | Yes, with a working proof of concept |
| False positives in the report | Common | None: every finding is reproduced by hand |
| Fix guidance | Generic | Written for the team that owns the code |
| Retest and remediation sign-off | Rerun the scan | Free retest for 90 days and a signed letter |
| Accepted for PCI DSS 11.4 and SOC 2 evidence | Not on its own | Yes, reports map to the framework |
How an Engagement Runs
Six steps, the same every time
Scoping call
20 minutes on what you need to prove and by when. Fixed-price quote follows.
Rules of engagement
Written scope, test windows, contacts and the systems we will not touch.
Testing
Automated coverage as the floor, then manual exploitation by senior operators.
Critical findings, right away
Anything critical is reported immediately following confirmation, not held for the final report.
Report and readout
Executive summary, technical findings with fixes, and a live walkthrough with your team.
Retest and attestation
Free retest within 90 days and a signed letter for auditors and customers.
See the Work Before You Buy
The team, the results and the report
Talk to the Consultant Who Will Lead the Work
Book a 20-minute scoping call. You leave with a clear recommendation and a fixed-price quote.
Book a Scoping Call See a Sample Report