VOIDSEC
Services

What we are
hired to do.

Four practices. Each one ends in a written deliverable your engineering team can schedule against, and a retest once the fixes land.

01

Security assessment

A technical review of the systems you run, approached the way an attacker would approach them.

In scope
  • Web and mobile applications, including authenticated and multi-tenant paths
  • Internal and external network exposure
  • Cloud configuration, identity boundaries and secret handling
  • Third-party and dependency exposure
What you get

Findings ranked by exploitability. Each one comes with the steps to reproduce it, the assets it affects and a fix that suits your stack. We retest once the fixes land.

02

Architecture and code review

Design-level review before a system ships, when a fix is still a sprint instead of a migration.

In scope
  • Authentication, session handling and token lifecycle
  • Authorisation and tenant isolation logic
  • Cryptographic choices and key management
  • Data flow, retention and exposure between services
What you get

A written review of the design decisions that carry risk, the failure each one permits and what you could do instead. We sit with your engineers and go through it.

03

Compliance readiness

Translating what the regulator expects into a backlog your engineering team can plan around.

In scope
  • Gap analysis against Law 05-20 and DGSSI guidance
  • CNDP obligations for personal data handling
  • ISO/IEC 27001 control mapping and evidence preparation
  • Sector requirements for financial and telecom operators
What you get

A gap register mapped to controls, sequenced by effort and risk, with the evidence an auditor will ask for identified up front.

04

Incident readiness

Testing whether the logging, the runbooks and the people behind them hold up under a realistic intrusion.

In scope
  • Detection and logging coverage review
  • Tabletop exercises against realistic intrusion paths
  • Runbook development and escalation mapping
  • Post-exercise gap remediation
What you get

A plain account of where your visibility stops, what your team could reconstruct after an intrusion, and the runbooks to cover the gaps.

Engagement model

How it
actually runs.

The same five steps whichever service you buy. Nothing starts before the scope is written down and signed by both sides.

A
NO CHARGE

Scoping call

Half an hour on a call. We work out what would be in scope and what we would be working around, and you get a straight answer on whether there is an engagement here at all.

B
IN WRITING

Rules of engagement

Assets, testing windows, escalation contacts and the boundary of what we will touch, all agreed and signed before anything starts.

C
LIVE CHANNEL

Testing

Critical findings reach you the day we confirm them rather than waiting for the report. You talk to the people doing the work.

D
WALKTHROUGH

Report

A written report your engineers can work from, presented to the people who have to implement it.

E
INCLUDED

Retest

Once the fixes land we verify them and reissue the report. It is included in the price.

Scoping calls open

Not sure
which?

Most people are not, and it is not your job to be. Describe the system and we will tell you what is worth doing first, including when the answer is nothing yet.

Request a scoping callcontact@voidsec.sh