Vulnerability Analysis & Penetration Testing

Securing Security

We counterattack to ensure the attack vectors thought of by malicious hackers are mitigated even before the security breach. We are PurpleHat Chief Penetration Testers.


Exact simulation of a hacker
with proper approvals from CIO/CISO/CSO to mitigate the risks.


Securing Information or Data
across the entire organisation ensuring resilient business continuity.


Assessing the security gaps or vulnerabilities
across the entire networks and systems to prioritise remediation.


The beginning of everything & unleashing the infinite security wisdom. The human element is always at the center in the Information Security Element. We are driven with Security by Consciousness – desire to SECURE security. Beyond the Security by Design and Beyond the Privacy by Design.
VA – Vulnerability Assessment
PT – Penetration Testing
Secure Sec’s Offensive Security focusses on accceptable ethical ways of penetrating the perimeter to remediate. We are Offensive to achieve Deffensive.

Penetration Testing

Manual Penetration Testing

Penetration testing is security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network. It often involves launching real attacks on real systems and data that use tools and techniques commonly used by attackers. Most penetration tests involve looking for combinations of vulnerabilities on one or more systems that can be used to gain more access than could be achieved through a single vulnerability.

Penetration testing can also be useful for determining:

  1. How well the system tolerates real world-style attack patterns
  2. The likely level of sophistication an attacker needs to successfully compromise the system
  3. Additional countermeasures that could mitigate threats against the system
  4. Defenders’ ability to detect attacks and respond appropriately.

Secure Sec Ltd utilizes the NIST methodology which is a widely adopted approach to performing penetration testing that is effective in testing the security of the CLIENT’s network. All of the examinations are conducted with publicly available and commercial tools.

External Penetration Tests follow best practice in penetration testing methodologies which generally includes 4 phases:

NIST Four-Stage Penetration Testing Methodology

1. Planning Phase:

In the planning phase, rules are identified, management approval is finalized and documented, and testing goals are set. The planning phase sets the groundwork for a successful penetration test. No actual testing occurs in this phase.

2. Discovery Phase:

The discovery phase of penetration testing includes two parts. The first part is the start of actual testing, and covers information gathering and scanning. Network port and service identification is conducted to identify potential targets. In addition to port and service identification, other techniques are used to gather information on the targeted network

  • Host name and IP address information can be gathered through many methods, including DNS interrogation, InterNIC (WHOIS) queries, and network sniffing (generally only during internal tests)
  • Employee names and contact information can be obtained by searching the organization’s Web servers or directory servers
  • System information, such as names and shares can be found through methods such as NetBIOS enumeration (generally only during internal tests) and Network Information System (NIS) (generally only during internal tests)
  • Application and service information, such as version numbers, can be recorded through banner grabbing.

The second part of the discovery phase is vulnerability analysis, which involves comparing the services, applications, and operating systems of scanned hosts against vulnerability databases (a process that is automatic for vulnerability scanners) and the testers’ own knowledge of vulnerabilities.

3. Attack Phase:

Executing an attack is at the heart of any penetration test and represents the individual steps of the attack phase—the process of verifying previously identified potential vulnerabilities by attempting to exploit them. While vulnerability scanners check only for the possible existence of a vulnerability, the attack phase of a penetration test exploits the vulnerability to confirm its existence. If an attack is successful, the vulnerability is verified and safeguards are identified to mitigate the associated security exposure.

In many cases, exploits that are executed do not grant the maximum level of potential access to an attacker. They may instead result in the testers learning more about the targeted network and its potential vulnerabilities, or induce a change in the state of the targeted network’s security. Some exploits enable testers to escalate their privileges on the system or network to gain access to additional resources.

4. Reporting Phase:

The reporting phase occurs simultaneously with the other three phases of the penetration test. In the planning phase, the assessment plan—or ROE—is developed. In the discovery and attack phases, written logs are usually kept and periodic reports are made to system administrators and/or management. At the conclusion of the test, Secure Sec Ltd prepares a report that describes identified vulnerabilities, present a risk rating, and give guidance on how to remediate the discovered weaknesses.


CONTACT CDI TODAY! Vulnerability Assessment Services


Vulnerability Analysis and Scanning analyzes the security of your network, applications and systems using the largest and most up-to-date Knowledge Base of vulnerability checks in the industry. When you launch or schedule vulnerability scans, the service safely and accurately detects vulnerabilities using its Inference-Based Scanning Engine, an adaptive process that intelligently runs only tests applicable to each host scanned.

The service first gathers information about each host, such as its operating system and version, ports and services, and then selects the appropriate test modules. The impact of scans on your network load is minimal because the service samples your available bandwidth and then uses a fixed amount of resources that you specify.

The Knowledge base of vulnerabilities is constantly updated as vulnerabilities are added and updated. For this reason, it is best practice to schedule network security audits regularly to minimize potential risk and ensure constant security. We recommend scheduling routine weekly scans plus running an on demand scan whenever new network devices are introduced or configurations are updated.

Secure Sec Ltd

With regular VAPT therefore, organisations tremendously reduce the chances of new vulnerabilities going unnoticed. In case there are any, it will take just a short time before they are discovered and eliminated from the network.

To help you achieve this, we have a competent penetration test team with vast experience in analysing and identifying threats that could potentially harm your information assets. Other than testing your network for vulnerabilities and penetrations, the team is also experienced in formulating remediation plans so that you are never caught flat-footed in the case of an attack.


  • Hybrid service which blends automated testing with security expert analysis for the best quality test coverage and to identify all possible attack vectors
  • Covers all OWASP Top 10, CVE / NVDB / SANS Top 20 vulnerabilities
  • Attack simulation, untraditional testing methodologies to simulate an attacker to discover security weakness
  • Security controls assessment to examine and assess various controls, technologies and procedures and identify points of failure
  • Vulnerability discovery and threat modelling to identify, quantify and rank vulnerabilities
  • PCI and ISO27001 compliance friendly reporting
  • Experts manually document details, descriptions, proof of concepts and references specific to your applications


Secure Sec Ltd – Digital Forensics Experts


Secure Sec Ltd has provided the most complete electronic discovery, forensic analysis, litigation support, and advisory and consultation services available in the marketplace. Secure Sec Ltd has conducted over 5,000 electronic discovery and forensic analysis cases over the past 2 years.

Secure Sec Ltd  has an unmatched background in the examination of digital evidence in order to support criminal investigations, civil litigations, and best security practices. Our team of forensic analysts possesses professional experience in both law enforcement and information technology.

With the increasing number of computer security and digital evidence related incidents and their associated losses,Secure Sec Ltd believes our Forensic Analysis services are key to our customers’ incident-response capabilities. To best inform our clients’ security posture, our analysts are trained to present technical findings in a detailed and readable format. This process lends clarity to the most complex cases and strengthens our customers’ ability to develop well-informed incident-response and security protocols. Our specialized consultants are qualified to provide expert witness testimony to support litigation.

Any investigation can twist and turn based on available evidence. Secure Sec Ltd guides electronic discovery and investigative processes, providing legal teams with sound advice and an expanded source of evidentiary information. We carefully learn the details of each case to conduct timely and thorough investigations. Our commitment to quality forensic examinations ultimately makes the difference in court.