who actually does the testing?
a person, not a scanner. the tester holds OSCP (Offensive Security Certified Professional, OffSec) and CPTS (Certified Penetration Testing Specialist, Hack The Box), and works the signed scope by hand. business-logic abuse and chained findings are the part no automated tool reports, and they are where most real breaches come from.
a scanner is a fine first pass. it isn't the test. automated tools compare your site against a list of known patterns and stop there. the findings that cost companies real money come from someone reading how your application is meant to work and then trying to make it do something else. that part is human work, and it's the part you pay for.
what the tester does with the scope
the tester works the signed scope by hand across the areas listed on the security page: authentication and sessions, access control between users and roles, input and file handling, cloud and hosting configuration, exposed secrets and admin surfaces, and your dependencies. two categories only a person finds:
- business-logic abuse: using the application exactly as built, in an order or combination nobody intended. a tool has no idea what your invoice flow is supposed to do.
- chained findings: three low-severity issues that together add up to one serious one. a scanner reports three lows and moves on.
why we name the certifications
"certified tester" on its own means nothing, so we spell ours out: OSCP from offsec and CPTS from hack the box. both are public, so you can check what each one requires instead of taking our word for it.
the same person who did the testing writes the report: every finding with steps to reproduce, the evidence, the severity and why, and a specific fix. if you want to see the difference between a checklist and a test, our pre-launch checklist is the checklist, and says so at the end.