How Congruent went from signed scope to a client-ready pen test report in a week, ahead of its first customer engagement.

Congruent finds where misalignment exists in companies and provides solutions to improve it. Its founder built the platform himself and needed two things before his first customer engagement: independent validation that it would not fail in front of a client, and an assessment that procurement would accept.

He had tested the platform extensively himself. His concern was the one every builder has: only an independent look tells you what you have missed. Having somebody independently look at what he had built was, in his words, a completely different story.

In his market, procurement teams ask what type of assessment has taken place before an engagement begins. The test was a precursor to being able to start delivering work at all. He wanted a standard high enough that it would not act as a ceiling on who he could work with. As it turned out, the client’s procurement department was looking for CREST accreditation.

He had no prior experience of penetration testing providers. He was working to a fixed deadline. And he was going on holiday: every test had to be wrapped up before he left, so the week he came back could be readiness checks rather than firefighting.

A penetration test of the web application, including its API and database, ahead of Congruent’s first customer engagement. We publish scope, not exploit detail.

• Web applicationThe platform the founder had built, tested before it went in front of a client.
• API and databaseCovered by the same engagement.
• RetestsRetesting is free for 12 months. Fixes made during the test were retested the same week.

1. SALESScope

   Super smooth, in his words. Good contact, and people stuck to what they said they would do. He likes moving at pace and having things ticked off.

2. ONBOARDINGSet up

   His profile was set up for him, the portal was straightforward and the Slack channels were clear. The technical conversation also offered introductions to people worth knowing.

3. TESTINGSee

   Each finding arrived mid-delivery with a code snippet, an explanation, the result and why it mattered. He never had to ask for clarification.

4. FIX AND RETESTFix

   The tester checked in mid-day, came back within a reasonable time frame and followed up at end of day as promised. Fixes were retested immediately.

5. REPORTHand over

   The report came over, he reviewed it and gave feedback points, and they were incorporated very quickly. About a week of elapsed time, not an open-ended one.

• ✓The customer requirement was met: a CREST-accredited test and a report ready to hand to the client’s procurement team.
• ✓Independent validation of what he had built, before the first client engagement rather than after it.
• ✓Everything raised was clear enough to act on without a single follow-up question, and it was all fixed and retested inside the week.
• ✓The biggest benefit was confidence: in his development approach, his testing approach, and the foundations he would build further features on.
• ✓He expects to re-engage when the pen test needs refreshing, or sooner if the platform moves on significantly.