Trust, verified.

Jeff Haswell scopes and leads every engagement and reviews every estimate and report before it goes out. Grant Spencer leads the technical testing — applications, APIs and the infrastructure under them — and the retests. Nobody is handed to an account manager, and the people who scope the work are the people who do it.

Yes, and increasingly that is where the serious findings are. We test against the OWASP API Security Top 10, including the endpoints that exist but never made it into the documentation — mobile, partner and internal APIs are often less protected than the public one.

A signed authorisation and rules of engagement, test accounts for each role, the environment URL, and any API documentation or OpenAPI specs you have. For grey-box testing, a short walkthrough from a developer saves days of discovery. We send a checklist during scoping.

For most web applications, grey box: we get credentials for each role and a walkthrough, which spends your budget on finding flaws rather than rediscovering what your team already knows. Black box simulates an outsider with nothing, and is usually less thorough per dollar. White box adds source code review, and suits teams who want the deepest assurance.

With CVSS v4.0, adjusted for your environment, and explained in plain words. We do not inflate severities to make a report look busy, and we do not bury real issues as “informational”. If something is technically a finding but practically irrelevant to you, we say so.

Yes. We run a gap assessment against the standard’s clauses and its 93 Annex A controls, help you build the information security management system and the Statement of Applicability, and prepare you for the certification body’s audit. Certification itself is issued by an accredited certification body, not by us.

Several requirements that were best practice became mandatory on 31 March 2025. For e-commerce the two that matter most are 6.4.3, which requires an inventory, authorisation and integrity check for every script on a payment page, and 11.6.1, which requires detecting unauthorised changes to those pages. We test for both and help you put the controls in place.

It is the 2024 update of NIST’s Cybersecurity Framework, organised into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern is new, and puts security ownership with leadership. It scales well to smaller organisations, which is why we use it to give leadership a one-page picture of where they stand.

Yes. Continuous testing covers each significant release or a fixed quarterly cadence, so new features are tested before your annual report goes stale. It suits teams shipping weekly, and is usually cheaper per test than separate engagements.

Our fractional security lead service gives you a named senior person for a set number of hours each month: answering customer security questionnaires, owning the risk register, preparing for audits and advising engineering. It is how many companies get through their first SOC 2 before they hire a CISO.

We help you prepare for incidents — response plans, playbooks and tabletop exercises that rehearse a breach before it happens. For a live incident, we will help you triage and find the right forensic and legal support quickly, but we are not a 24/7 incident response retainer and will not pretend to be.

As if they were the most sensitive thing we hold, because they are. Findings are stored encrypted, shared through an access-controlled portal rather than email attachments, and deleted on a schedule we agree. Test data we create is removed at the end of the engagement, and we sign your NDA as a matter of course.

Both. Each report includes a specific remediation recommendation, and we are available to your developers while they fix — reviewing a proposed patch is faster and cheaper than discovering at retest that it missed a case.

We are based in Calgary, Alberta, and work with clients across Canada and the United States. Almost all testing is done remotely; on-site work is available for physical and internal network assessments.

Run the estimator for a range, or email hello@penspycyber.com and we will set up a scoping call. It helps to come with one thing: who is asking you for proof, and by when. That usually decides what kind of engagement you need.