Artery Systems

Penetration testing

Know your exposure before attackers do.

We test only what you authorize, within scope and under a signed agreement, then deliver a plain‑English report and retest your fixes.

Book a scoping call

How an engagement runs

No testing before the agreements are signed.

Seven steps, always in this order, with the fee agreed at the outset.

  1. 01

    Scoping call

  2. 02

    Scoping questionnaire

  3. 03

    MSA, SOW, rules of engagement

  4. 04

    Testing within scope

    Critical findings reported immediately
  5. 05

    Live findings review

  6. 06

    Report delivered

  7. 07

    Fixes retested

What you sign

Each document, explained.

Three to sign, one to receive, all drafted for your engagement and reviewed with you in advance.

MSA

Signed once

Master Services Agreement

The standing terms of the relationship.

MSA outline
  1. Parties and definitions
  2. Services and statements of work
  3. Confidentiality
  4. Data handling and return
  5. Fees and payment
  6. Liability and indemnity
  7. Term and termination
  8. General terms
SOW

Signed per engagement

Statement of Work

This engagement, defined in writing.

SOW outline
  1. Objectives
  2. In-scope targets
  3. Out-of-scope systems
  4. Schedule
  5. Approach and test types
  6. Deliverables
  7. Fee and payment terms
  8. Assumptions and contacts
RoE

Signed before testing

Rules of Engagement and Authorization

Written permission, with defined limits.

RoE outline
  1. Authorizing party and signatory
  2. Systems covered, by name or address
  3. Allowed and prohibited methods
  4. Testing hours and time zone
  5. Tester source addresses
  6. Emergency contacts and stop procedure
  7. Handling of data found in testing
  8. Signatures
Report

Delivered after testing

Penetration test report

The record of what was found.

Not for signature: this is what the engagement produces, laid out further down.

Go to the report structure

Professional conduct

Absolute limits.

  1. The right signatory

    Authorization must come from whoever controls the systems, not only the person who booked the call.

  2. Scope is a hard boundary

    A system not on the list is left untouched and reported to you.

  3. Findings stay confidential

    Shared only with the contacts named in the SOW and handled under the MSA.

  4. Pause on request

    Testing halts as soon as either party asks, through the agreed contacts.

The report

What the report contains.

Written for two audiences: leadership, who need the summary, and the engineers responsible for remediation.

  1. 01

    Executive summary

  2. 02

    Scope and method

  3. 03

    Findings with severity ratings

  4. 04

    Evidence and reproduction steps

  5. 05

    Remediation guidance

  6. 06

    Retest results

Illustrative sample, not client data

6findings

CVSS v4.0 severity

  • Critical
  • High
  • Medium
  • Low
  • Info
F-01 Fixed, retested

Invoice API returns other accounts’ records

High CVSS v4.0 · 7.1
Location
api.example.com/v1/invoices/{id}
Category
OWASP API Security Top 10 (2023), API1: Broken Object Level Authorization
Confidence
Confirmed, reproduced with two test accounts
Observed
Testing day 2, 14:12 UTC
Retested
After remediation, 10:05 UTC

Established

A signed-in user can read another account’s invoice by changing its ID.

Not established

Whether real customer records were exposed. Only test accounts were used.

  1. EntryInternet
  2. Sign-inapp.example.com
  3. SessionTest user A
  4. RequestGET /v1/invoices/{id}F-01
  5. ImpactTest user B’s invoice
GET /v1/invoices/10482 HTTP/1.1
Host: api.example.com
Authorization: Bearer redacted

HTTP/1.1 200 OK
{"invoice": 10482, "account": "redacted",
 "email": "redacted", "total": "redacted"}

Signed in as test user A. Invoice 10482 belongs to test user B.

  • F-01Invoice API returns other accounts’ recordsHighFixed, retested
  • F-02No rate limit on sign-inMediumPartially fixed
  • F-03Storage container lists file namesMediumFixed, retested
  • F-04TLS 1.0 still enabledLowOpen

Scope builder

Define the scope before the call.

Test areas

Your scope

No areas selected.

What to prepare

  • A signatory for the testing authorization
  • An emergency contact for the testing window

What the SOW will define

  • Testing dates and hours
  • Deliverables: report, walkthrough, retest
  • The fixed fee
Reserve a time with this scope

Your selections are attached to the booking request. Nothing is stored on this page.

When to test

Situations that warrant a test.

  • A buyer has sent a security questionnaire.

    A scoped test supplies an accurate answer and a ranked list of fixes.

  • Client files that must stay confidential.

    An external test shows where an outsider could gain entry.

  • A major release is about to go live.

    New features and integrations change what can be reached from the internet.

A penetration test reports what was found within the agreed scope and dates. It supports a questionnaire answer; it does not guarantee security or an audit outcome.

Set a date for your first test.

We begin with the systems of greatest concern and close with a recommended approach.

Choose a call time