PHX-2026-014 · WEB APPLICATION
Broken object-level authorization on invoice API
VERIFIED MANUALLY
Repro steps · Fix guidance · Retest incl.
End to end securityDetectionMitigationProtection
Find every gap.
Fix it fast.
Stay protected.
Phantom Cybersecurity hunts down the weaknesses attackers would use, works with your engineers until every one is closed, then defends your network, cloud, endpoints and people around the clock. Book a review and know exactly where you stand within two weeks.
Exploited, not just flagged. Every finding is verified and reproduced by hand.
Senior-led, start to finish. The people who scope your test also run it.
NDA-first by default. Encrypted evidence and least-privilege access.
Fixed & retested. We retest every fix and reissue the report.
PHX-2026-021 · CLOUD / AWS
Public S3 bucket exposing customer exports
REMEDIATED · RETESTED
Closed in 6 days
Excerpts from a Phantom Cybersecurity assessment report. Client details redacted.
Detect. Senior-led testing that finds what scanners miss
Mitigate. Fix guidance and retesting until every gap is closed
Protect. Layered defence with 24/7 monitoring and response
Assure. Written authorization and production-safe rules throughout
CAPABILITIES
Eight core services. One standard of evidence.
Everything we report is discovered, exploited or verified by hand, rated for real business impact, and paired with remediation guidance your engineers can implement.
Application & API Penetration Testing
Manual testing of web apps, APIs, authentication, authorization, business logic, and tenant isolation across customer-facing systems. It's the assessment auditors, partners and regulators ask for by name.
- Web app & API exploitation, by hand
- Authentication & authorization abuse
- Cross-tenant isolation testing
- Business logic & workflow attacks
Vulnerability Assessment
Structured vulnerability discovery across applications, infrastructure, cloud assets, and exposed services, prioritized by risk instead of scanner noise.
Cloud Security Review
AWS, Azure, and Google Cloud reviews covering IAM, storage, Kubernetes, logging, permissions, and exposed assets.
External Attack Surface Review
Domains, subdomains, ports, services, exposed panels, and leaked assets: your perimeter as attackers see it.
Compliance & Audit Readiness
Control gap reviews, evidence preparation, policy development, and audit support, without the theater. The badge follows the security, not the other way around.
SOC 2ISO 27001PCI-DSSHIPAAGDPRDPDP
Security Questionnaire Support
Accurate, ready-to-send answers for security questionnaires, procurement reviews, and due diligence requests.
Incident Response & Triage
Investigation and containment for account compromise, BEC, ransomware, and cloud exposure, with a 24/7 escalation path through our SOC operations network.
Virtual CISO & Security Advisory
Senior security leadership on retainer: roadmap planning, risk prioritization, policy development, and executive guidance.
Also delivered by our team and specialist network: managed detection & response (MDR) and 24/7 SOC monitoring, mobile app testing, source code review (SAST/DAST), red / blue / purple team exercises, phishing simulation & security awareness training, email security (DMARC, SPF, DKIM), threat intelligence & dark web monitoring, ransomware readiness, tabletop exercises for leadership, digital forensics, and cyber insurance readiness. If it isn't something we can deliver to our standard, we'll tell you, and refer you to someone who can.
Frameworks we work against
SOC 2ISO 27001PCI-DSSHIPAAGDPRDPDPNIST CSFCIS ControlsOWASPMITRE ATT&CK
DEFENCE IN DEPTH
Any single control can fail. The architecture shouldn't.
Modern attacks come in stages, so protection has to come in layers. We build and run independent controls that back each other up. When something slips past one layer, the next one stops it.
Every layer is explained in plain English, so your leadership always knows what is protected and why it matters.
Map your coverage on a scoping call- 01PerimeterEvery connection is inspected before it reaches your network.
- 02EndpointsMalware and ransomware caught on every laptop and server, in real time.
- 03EmailFake invoices and impersonation stopped before they reach an inbox.
- 04Identity & accessLeast privilege everywhere. Admin logins vaulted, with approvals.
- 05DataConfidential files can't quietly leave over email, USB or upload.
- 06DevicesA lost phone or laptop gets wiped before it becomes a breach.
- 07NetworkUnknown devices are refused at the switch and on the Wi-Fi.
- 08CloudMisconfigurations found and closed before anyone else finds them.
- 09HardeningSystems patched, encrypted and current. Known exploits stay closed.
- 10Backup & recoveryTested restores turn ransomware into an inconvenience, not a crisis.
- 11Monitoring & responseA 24/7 SOC watches the whole environment and acts within minutes.
- 12People & governanceStaff trained and tested regularly. A retained advisor keeps the whole programme current.
ENGAGEMENTS
Clear scope. Fixed price. No surprises.
SaaS Penetration Test
For SaaS teams that need an external security test to protect your data and clear security reviews.
- Web app & API testing
- Authentication & authorization
- Tenant isolation checks
- Business logic testing
- Report + remediation walkthrough
API Security Assessment
For products with sensitive workflows, user data, or partner integrations.
- Endpoint mapping
- Auth & object-level access testing
- Rate limit & abuse case testing
- Sensitive data exposure review
Cloud Exposure Review
For teams worried about misconfigurations and fast-growing cloud footprints.
- IAM & privilege review
- Public asset & storage discovery
- Network exposure & logging review
- Risk-ranked remediation plan
SOC 2 Readiness Sprint
For companies preparing for SOC 2 or security due diligence.
- Control gap review
- Evidence checklist & policy review
- Questionnaire support
- 30/60/90-day roadmap
Virtual CISO Advisory
For companies that need senior security guidance without a full-time hire.
- Security roadmap & risk prioritization
- Executive reporting
- Policy guidance
- Security questionnaire & review support
Incident Triage Call
For suspected compromise, suspicious activity, or urgent security uncertainty.
- Initial situation & log review
- Containment recommendations
- Escalation guidance
- Next-step plan, same day
Managed Defence Retainer
For teams that want the people who found their gaps to keep them closed. We run your layered defence end to end and report in plain English every month.
- 24/7 monitoring and response through our SOC
- Managed detection and response on every endpoint
- Patching and hardening on a fixed cadence
- Phishing simulation and staff training
- Quarterly programme review with a retained advisor
METHOD
A controlled process, from scope to retest.
Every engagement runs under written authorization and agreed rules of engagement. You always know what's being tested, when, and by whom.
STEP 01 — 30 MIN
Scoping call
We map your systems, goals and deadlines, whether that's an audit, a security review or peace of mind.
STEP 02 — 1–2 DAYS
Proposal & rules of engagement
Fixed scope, fixed price, testing windows, safety rules, and an emergency pause process.
STEP 03
Access setup
Test accounts, read-only cloud roles, and secure evidence channels. Nothing more than needed.
STEP 04 — 1–2 WEEKS
Testing & review
Senior-led manual testing. Critical findings are escalated immediately, not held for the report.
STEP 05
Report & walkthrough
Written findings with evidence and repro steps, then a live session with your engineers.
STEP 06 — INCLUDED
Remediation & retest
Fix support, verification retesting, and a shareable summary. When you want us to stay on, the same team moves straight into managed defence.
Typical end-to-end: 2–3 weeks from signed proposal to delivered report for a focused assessment. Urgent timelines for security reviews or audits can usually be accommodated. Tell us your deadline on the scoping call.
DELIVERABLES
The report is step one. Staying secure is the rest.
No scanner dumps. Every Phantom Cybersecurity report is written three times over: for your executives, your engineers and your auditors. And the work doesn't stop at the PDF. We help you fix every finding, verify each fix, and keep watch from there.
- Executive summary
- Technical findings with evidence
- Reproduction steps
- Risk rating & business impact
- Affected assets
- Risk-ranked remediation plan
- Engineering remediation call
- Retest & closure notes
- Shareable summary
- Optional 30/60/90-day roadmap
Findings summary
SAMPLE-2026-R2 · P.04
PHX-001
Broken object-level authorizationInvoice API · cross-tenant read
Critical
PHX-002
Missing MFA on privileged accountsAdmin console · 4 accounts
High
PHX-003
Public cloud storage exposureS3 · customer export bucket
Medium
PHX-004
Missing audit loggingAuth events · IAM changes
Medium
PHX-005
Outdated service with known CVEEdge proxy · patch available
Low
Keep the same team on the problem
Once findings are fixed and retested, we stay on to monitor, respond and advise, so the systems we hardened stay that way.
CLIENT OUTCOMES
What it's like to work with us.
Security work is confidential by nature. Client names are withheld under NDA. References are available on request during scoping.
We’d been stuck in a Fortune 500 vendor security review for two months. Phantom Cybersecurity scoped the test in a week, found three critical issues our previous vendor never touched, then worked with our engineers until every one was fixed and retested. The review cleared the same month.
The review paid for itself before the report arrived. They flagged a public storage bucket holding customer exports on day two and walked us through the fix the same afternoon. They watch our cloud posture continuously now.
Our SOC 2 prep was drowning in consultant theater. Phantom Cybersecurity mapped the gaps to what we actually run, wrote policies our team could live with, and the audit passed with zero exceptions.
The first security firm that stayed until the work was done. Every finding came with reproduction steps, their team helped ours ship the fixes, and the retest closed the loop for our auditors.
We thought we’d been breached on a Sunday night. They were on a call within the hour, helped us contain it, and had a clear picture by morning. Calm, fast, no theatrics.
We came for a one-off pen test and never left. The same team now runs our detection and response, so nothing gets lost in a handoff. They already know our stack cold.
Our board wanted a security roadmap they could trust. Their virtual CISO built one around our real risks, and the monthly reviews keep us honest between audits.
Quotes lightly edited for length. Client identities withheld under NDA.
TRUST
Built to be trusted with sensitive systems.
You're granting access to production-adjacent systems, source code, and evidence of your weakest points. We treat that access accordingly.
How we handle your data
Confidentiality is a working practice, not a paragraph in a contract.
- NDA-friendly engagements as standard
- Secure, encrypted evidence handling and file exchange
- Client-approved communication channels only
- Findings shared exclusively with approved contacts
- Limited data retention with defined deletion timelines
- No unnecessary access requests. Least privilege applies to us too
How we test safely
Testing is controlled, authorized, and reversible at all times.
- Written authorization required before any testing begins
- Agreed rules of engagement and approved testing windows
- Production vs. staging policy defined up front
- No destructive testing without explicit approval
- Rate limits respected; read-only cloud access where possible
- Emergency pause process and named escalation contact
FIT
We'd rather be a great fit than a big list.
Strong fit
- B2B SaaS and API-first product companies
- Fintech, BFSI, healthtech and pharma teams handling sensitive data
- Seed to Series B startups selling to enterprise customers
- CTO- and founder-led engineering teams
- Companies preparing for SOC 2, ISO 27001, or security reviews
- Growing SMEs building practical security maturity
- Teams that want one partner from first test to ongoing defence
Probably not a fit
- Teams looking for the cheapest checkbox pen test
- Teams that only want automated scanner output
- Companies unwilling to fix critical issues
- Teams looking for hardware resale or general IT support
- Companies that need a 5,000-person consultancy on the letterhead more than they need findings
WHO WE ARE
Senior practitioners. Small by design.
Phantom Cybersecurity was founded in 2022 by practitioners who spent years running offensive security and defence operations. We stay deliberately small. The people who scope your engagement are the people who test your systems, help fix what they find, and stand behind the results. Behind them sits a 24/7 SOC operations network for monitoring, response and escalation.
Certified from the ground up
Our practitioners hold and train against recognised industry certifications, from foundational to advanced, across offensive security, cloud and governance.
- Security+CompTIA Security+CompTIA
- CCNACisco Certified Network AssociateCisco
- CCNPCisco Certified Network ProfessionalCisco
- CEHCertified Ethical HackerEC-Council
- CySA+CompTIA Cybersecurity AnalystCompTIA
- CBRFIRCybersecurity Forensic Analysis and Incident ResponseCisco Certified Specialist
- PenTest+CompTIA PenTest+CompTIA
- eCPPTCertified Professional Penetration TesterINE Security
- BSCPBurp Suite Certified PractitionerPortSwigger
- CRTPCertified Red Team ProfessionalAltered Security
- CRTOCertified Red Team OperatorZero-Point Security
- OSCPOffensive Security Certified ProfessionalOffSec
- GPENGIAC Penetration TesterGIAC / SANS
- AWS SecurityAWS Certified Security, SpecialtyAWS
- OSWEOffensive Security Web ExpertOffSec
- OSEPOffensive Security Experienced Penetration TesterOffSec
- CCSPCertified Cloud Security ProfessionalISC2
- CISSPCertified Information Systems Security ProfessionalISC2
- CISMCertified Information Security ManagerISACA
- 27001 LAISO/IEC 27001 Lead AuditorISO/IEC
Certifications held across the team and its specialist network.
PRINCIPLES
Struck from our practice.
Replaced with something better.
-
Never:
selling fearWe report verified risk and its real business impact. Nothing inflated, nothing invented. -
Never:
scanner output dumped into a PDFEvery finding is manually validated, reproduced, and evidenced before it reaches your report. -
Never:
compliance theaterReadiness work grounded in how attackers actually operate. The badge follows the security, not the other way around. -
Never:
pushing tools before understanding riskWe understand your systems first, and recommend only what your risk actually warrants. -
Never:
taking work we can't deliver wellWe take only what we can deliver to our own standard, and refer the rest to someone who can. -
Never:
unauthorized testingWritten authorization and agreed rules of engagement on every engagement. No exceptions, ever.
Phantom Cybersecurity is a specialist team of senior security practitioners, backed by a 24/7 SOC operations network. The people who scope your engagement are the people who test your systems and stand behind the findings.
QUESTIONS
Questions we hear before every engagement.
Do you sign NDAs?
Yes. We're happy to work under your NDA or provide ours. Confidentiality terms are standard in every engagement agreement, and they cover evidence, findings, and even the fact of the engagement itself if you prefer.
Can we share the report with others?
Yes, that's usually the point. Alongside the full technical report, we prepare a shareable summary designed for partners, auditors, and vendor-risk teams: it confirms scope, methodology, and remediation status without exposing sensitive technical detail.
Do you test production systems?
Only under agreed rules of engagement. We define a production vs. staging policy up front, respect rate limits, avoid destructive testing without explicit approval, and maintain an emergency pause process with a named escalation contact throughout testing.
How long does a penetration test take?
A focused assessment typically runs 1–2 weeks of testing, with the report delivered shortly after. End to end, from scoping call to delivered report, most engagements complete in 2 to 3 weeks. Urgent deadlines for security reviews or audits can usually be accommodated.
Do you provide retesting after we fix issues?
Yes, retesting of remediated findings is included in our standard engagements. You get closure notes confirming each fix, which strengthens the report when you share it with auditors or partners.
What access do you need?
The minimum required for the agreed scope: typically test accounts at relevant permission levels and, for cloud reviews, read-only roles. We never request more access than the engagement needs, and all access is removed at the end of testing.
What's the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment gives you breadth: structured discovery of weaknesses across your systems, prioritized by risk. A penetration test gives you depth: manual exploitation of specific targets to prove what an attacker could actually achieve. Many clients start with an assessment, then test their highest-risk systems. We'll recommend the right starting point on the scoping call.
Do you offer ongoing monitoring or managed detection & response?
Yes. Through our security operations network we provide managed detection & response (MDR), covering SIEM, EDR, and real-time threat monitoring, with 24/7 coverage and incident response escalation. Assessment clients often move to MDR after remediation; we'll recommend it only if your risk profile actually warrants it.
Can you help with an urgent security review?
Yes. Security questionnaire support and security review preparation are core services, and they're often time-critical. If a security review is waiting on your answers, mention it in the form below and we'll prioritize the scoping call.
CONTACT
Book a security review.
Tell us what you're building and what's at stake. We'll respond within one business day with next steps, usually a 30-minute scoping call.
- General inquirieshello@phantomcybersecurity.in
- Suspected incident?Mark your message "URGENT — INCIDENT" and it routes to our triage queue immediately.
- Sensitive details?Keep the first message high-level. We'll establish a secure channel before anything confidential is shared.