Bloomwiz Security · Offensive
Offensive Security as a Service
Find what an attacker would find, on a schedule that matches how often you ship. Application, API, infrastructure, cloud and adversarial testing, with every finding reproduced by hand before it reaches your report.
- Every finding reproduced by hand
- CVSS v4 severity scoring
- Retests included as standard
- Delivered in house, not subcontracted
Why a service
Why a service, not a one off test
An annual penetration test tells you about one day of the year. Most companies release far more often than that, and the gap between release and assessment is where exposure accumulates.
Offensive Security as a Service replaces the annual event with an ongoing arrangement: an agreed number of assessments across the year, retests included as standard, and a single view of what is open and what is closed.
Scope
Five pillars, scoped individually
Nothing here is bundled. You scope exactly what you need, in black box or grey box, external or internal, as a one off, periodically or continuously.
01 Application and API security
Web, API, mobile and thick client testing, secure code review, software composition analysis and threat modelling.
02 Infrastructure, network and cloud
External and internal network testing, wireless, segmentation, hardening review, cloud facing assets and IoT and OT.
03 Adversarial emulation
Red team, purple team, breach and attack simulation, continuous red team and social engineering.
04 AI security and exposure management
LLM and agentic AI testing, AI security posture, attack surface and threat exposure management, vulnerability management.
05 DevSecOps and secure SDLC
Maturity assessments, pipeline integration, secrets detection, infrastructure as code and container security gates.
01 Application and API security
| Service | What it covers |
|---|---|
| Web application penetration testing | OWASP Top 10, injection, authentication, authorisation and business logic flaws. |
| API penetration testing | REST and GraphQL authentication, authorisation and input validation, against the OWASP API Security Top 10. |
| Mobile application security testing | iOS and Android application, API and local storage, black box and grey box. |
| Thick client penetration testing | Desktop client, local storage and backend communications. |
| Secure code review | Static analysis and manual review, traced from the stated requirement into the code that implements it. |
| Software composition analysis | Third party and open source dependency risk. |
| Threat modelling | STRIDE based design stage threat identification, before anything is built. |
02 Infrastructure, network and cloud
| Service | What it covers |
|---|---|
| External network penetration testing | Perimeter exploitation from an attacker’s position. |
| Internal network penetration testing | Lateral movement, Active Directory and identity abuse. |
| Internal vulnerability assessment | Authenticated scanning and analysis across the estate. |
| Wireless penetration testing | Wi-Fi, rogue access points and wireless segmentation. |
| Network segmentation audit | Zone isolation and firewall rule validation. |
| Configuration and hardening review | Device and operating system baselines against CIS Benchmarks. |
| Cloud facing asset penetration testing | Internet facing cloud assets and cloud hosted network devices. |
| IoT and OT security testing | Embedded and industrial device security. |
03 Adversarial emulation
| Service | What it covers |
|---|---|
| External red team | Goal based adversary emulation from outside the perimeter. |
| Internal red team | Assumed breach emulation from inside it. |
| Purple teaming | Joint exercises run with your defenders, so detection improves while testing happens. |
| Breach and attack simulation | Automated, continuous validation that your controls actually fire. |
| Continuous red team | Ongoing goal based adversary simulation rather than a single exercise. |
| Social engineering | Phishing and physical intrusion. |
All of this is delivered in house by our own team, not subcontracted.
04 AI security and exposure management
| Service | What it covers |
|---|---|
| AI and LLM security testing | Prompt injection, jailbreak and model abuse testing, against the OWASP LLM Top 10. |
| Agentic AI penetration testing | Autonomous agent attack surface and tool abuse. |
| AI security posture management | AI system posture and governance against ISO/IEC 42001 and the NIST AI Risk Management Framework. |
| External attack surface management | Continuous discovery of what of yours is reachable from the internet. |
| Continuous threat exposure management | Prioritised, continuous exposure reduction rather than a quarterly scan report. |
| Vulnerability management | Programmatic management across the estate, ranked by what is actually exploitable. |
05 DevSecOps and secure SDLC
| Service | What it covers |
|---|---|
| DevSecOps maturity assessment | Pipeline security maturity against OWASP DSOMM. |
| Secure SDLC maturity assessment | Development lifecycle maturity against SAMM, BSIMM and NIST SSDF. |
| Pipeline integration | Security gates embedded in CI/CD rather than bolted on after. |
| Secrets detection and prevention | Credential and secret leakage, in the repository and in the pipeline. |
| Infrastructure as code scanning | Terraform and CloudFormation misconfiguration. |
| Container security gates | Image and registry scanning enforced in CI/CD. |
| DevSecOps managed service | Ongoing pipeline security operations. |
This is the pillar where being an engineering company shows. We are not advising from outside on a pipeline we have never run.
Method
How a test runs
- 01
Scoping
Targets, environment, test accounts, rules of engagement and dates agreed in writing.
- 02
Testing
Executed against the agreed scope, with daily contact and immediate escalation of anything critical.
- 03
Validation
Every candidate finding reproduced manually. Anything that cannot be reproduced is discarded.
- 04
Reporting
Findings scored on CVSS v4, each with evidence, business impact, the specific fix and a verification step.
- 05
Remediation
Your developers fix it, or ours do.
- 06
Retest
Re executed against the original finding, with written confirmation of closure.
Delivery
Engagement modes
Assessment
Point in time testing and reporting. A penetration test, a red team.
Advisory
Maturity assessment and design guidance. Secure SDLC, DevSecOps, AI posture.
Managed
An ongoing operated service. Vulnerability management, DevSecOps operations.
Continuous
Always on validation and exposure reduction. BAS, continuous red team, CTEM, attack surface management.
Deliverables
What you receive
- A technical report written for the people who have to fix it, naming the component and the change.
- An executive summary written for the people who have to fund it.
- A findings register tracking open and closed status across the year.
- A retest certificate for closed findings, suitable for sharing with customers and auditors.
Fit
Who this is for
- Companies shipping software frequently.
- Companies being asked for evidence of testing by enterprise customers.
- Companies with a compliance deadline.
- Companies who have had a test before and never closed the findings.
FAQ
Frequently asked questions
What is penetration testing?
Penetration testing is authorised, hands-on attack simulation against an application, network or cloud environment to find weaknesses an attacker could exploit, and to show how serious each one is.
What is the difference between black box and grey box testing?
Black box testing starts with no credentials, like an outsider. Grey box testing is credentialed, so testers can reach the functionality behind a login and every user role can be examined. Grey box usually finds more.
How do you make sure findings are real?
Every candidate finding is reproduced manually, and anything that cannot be reproduced is discarded rather than reported. A consultant validates every finding, including those surfaced with AI assistance.
What happens after the report?
Your developers fix the findings, or ours do. We then re-execute against the original findings and issue written confirmation of closure, as a retest certificate you can share with customers and auditors.
How often should we test?
As often as you ship. An annual test describes one day of the year, so Offensive Security as a Service uses an agreed number of assessments across the year, with retests included.
Talk to us
Not sure where to start?
A thirty minute conversation, no charge, and an honest view of what you actually need first. Most companies need less than they fear and something different from what they expected.