Services on Yeti.Security — Pen-testing & security consulting

Penetration Testing

Thu, 15 Jan 2026 00:00:00 +0000

A scoped, time-boxed assessment against a defined surface. The most common engagement shape we run.

What’s in scope

Web applications — production-grade SPAs, APIs, admin consoles
Mobile — native iOS and Android binaries plus their backends (OWASP MASTG)
REST & GraphQL APIs — including auth-token replay, IDOR, rate-limiting
Cloud configuration — AWS, GCP, Azure (read-only review)

We do not test customer-leased on-premises hardware, third-party SaaS we don’t host, or anything you don’t have written authorization to test.

Red Team Engagement

Thu, 15 Jan 2026 00:00:00 +0000

A simulated adversary campaign with a defined objective (“exfiltrate the customer-PII bucket”, “deploy ransomware to the build server”, “obtain a production AWS access key”), tested across as many vectors as it takes.

What gets tested

Initial access — phishing, smishing, OSINT, supply-chain via dependency
Lateral movement — once in, can we move? what’s logged?
Privilege escalation — IAM, group policy, sudoer files, the lot
Detection & response — does your SOC see us? in how long? what gets paged?
Exfiltration — the final boss: can we leave with what we came for?

How it runs

Four-week minimum, six-week typical. We coordinate timing with a single point of contact on your side (usually CISO or VP Eng) who is not in the SOC. The SOC doesn’t know we’re coming — that’s the point.

Security Consulting

Thu, 15 Jan 2026 00:00:00 +0000

A monthly retainer for teams who want senior security guidance without hiring a full-time security engineer. The right shape for most Series A–B companies.

What’s included

Fractional CISO — a named senior practitioner who attends your weekly security/eng review and answers Slack
Threat modeling — quarterly half-day sessions to map what you’re shipping against what attackers want
Architecture review — every major system gets a read before it ships
SDLC integration — we set up the linters, the dependency scanning, the secret-detection in your CI, and tune them so they don’t get ignored
Incident retainer — on-call coverage for the first 24 hours of any declared incident; we then hand off to a forensics partner

How it works

Eight hours/week, billed monthly. We don’t track hours within the month — this isn’t an agency.