FAQ | Peitharchia

Question 1

What does Peitharchia do?

Accepted Answer

Peitharchia provides security assessments for startups and growing technology companies. We review applications, cloud environments, infrastructure, and compliance readiness to identify risks, explain their impact, and recommend what to address first. Our work is practical and scoped to what matters for your organization at its current stage.

Question 2

Who are your assessments designed for?

Accepted Answer

Our assessments are designed for startups and growing technology companies that are building or operating web applications, APIs, or cloud-based infrastructure. This includes companies preparing for enterprise sales, handling sensitive user data, approaching a compliance requirement, or simply wanting to understand their current security posture before a problem occurs.

Question 3

Do I need a dedicated security team to work with you?

Accepted Answer

No. Most of our clients do not have a dedicated security team. We work directly with founders, engineering leads, and CTOs. We explain findings in plain language and provide remediation guidance that your existing engineering team can act on without specialized security expertise.

Question 4

How is Peitharchia different from automated scanning tools?

Accepted Answer

Automated scanners identify known vulnerability patterns but miss business logic flaws, authorization issues, chained vulnerabilities, and context-specific risks. Our assessments combine manual testing with technical analysis to find issues that automated tools routinely overlook. We also provide business impact context and prioritized remediation guidance — not just a list of findings.

Question 5

What does 'written authorization' mean and why is it required?

Accepted Answer

Written authorization is a formal agreement — typically a signed statement or contract — that explicitly permits security testing on specific systems within a defined scope. It protects both parties: it confirms you have the authority to authorize testing on the systems involved, and it establishes clear boundaries for what we are permitted to test. We will not begin any testing without written authorization in place.

Question 6

What is included in the scope definition?

Accepted Answer

The scope document identifies exactly what will be assessed — specific applications, URLs, API endpoints, cloud environments, infrastructure components, or compliance frameworks. It also defines what is excluded, testing constraints (such as production vs. staging), acceptable testing windows, rate limits, and any systems that should not be touched. Both parties agree to the scope before testing begins.

Question 7

Can you test systems hosted by a third-party provider?

Accepted Answer

It depends on the provider and what is being tested. Many cloud providers (AWS, GCP, Azure) permit security testing of your own resources without prior approval, subject to their acceptable use policies. Some providers require advance notification. We review applicable policies during scope definition and will not test any system without confirming that testing is permitted.

Question 8

Will testing affect my production environment?

Accepted Answer

We discuss this during scope definition and work to minimize any disruption. Where possible, we prefer to test against a staging or non-production environment. When production testing is necessary, we agree on testing windows, rate limits, and constraints in advance. We do not perform destructive testing or actions that could cause data loss or service disruption without explicit discussion and agreement.

Question 9

How long does an assessment take?

Accepted Answer

Duration depends on the scope and type of assessment. A focused application security assessment typically takes one to two weeks from the start of testing to delivery of the final report. Cloud and infrastructure reviews and compliance readiness assessments vary based on the complexity of the environment. We provide a timeline estimate during scope definition.

Question 10

What access or information do you need from us?

Accepted Answer

This depends on the assessment type. For application assessments, we typically need test accounts with appropriate access levels, API documentation if available, and information about the technology stack. For infrastructure reviews, we may need read-only access to cloud configurations. For compliance readiness, we review existing policies, procedures, and control documentation. We discuss specific requirements during scope definition.

Question 11

Do you perform black-box, grey-box, or white-box testing?

Accepted Answer

We use the approach that produces the most useful results for your situation. Grey-box testing — where we have some context about the application and authenticated access — is most common for application assessments because it allows us to test authorization logic, business workflows, and authenticated functionality that black-box testing would miss. We discuss the appropriate approach during scope definition.

Question 12

Will you notify us if you find a critical issue during testing?

Accepted Answer

Yes. If we identify a critical vulnerability during testing — one that poses immediate and significant risk — we will notify you promptly rather than waiting for the final report. We discuss communication preferences and escalation contacts during scope definition so you know how to expect to hear from us.

Question 13

What does the final report include?

Accepted Answer

Every report includes an executive summary, a prioritized list of findings with risk ratings, evidence and reproduction steps for each finding, business impact analysis, and remediation recommendations. The executive summary is written for non-technical readers. Technical sections provide the detail your engineering team needs to reproduce and fix each issue. For compliance assessments, the report also includes a gap mapping against the relevant framework.

Question 14

How are findings prioritized?

Accepted Answer

Findings are prioritized by a combination of severity, exploitability, and business impact in your specific environment — not just by CVSS score. A vulnerability that is technically high-severity but difficult to exploit in your environment may be rated lower than a medium-severity issue that is trivially exploitable and directly affects sensitive data. We explain our reasoning for each rating in the report.

Question 15

Do you provide a remediation review after we fix the findings?

Accepted Answer

Optional follow-up validation testing is available to confirm that critical findings have been addressed correctly. This is a targeted review of the specific fixes applied — not a full re-assessment. We recommend validation testing for critical and high-severity findings where incorrect remediation could leave the underlying risk unaddressed.

Question 16

Can we share the report with customers or auditors?

Accepted Answer

Yes. The report is yours to share as you see fit. Many clients share executive summaries or full reports with enterprise customers, auditors, or investors as evidence of security due diligence. We can also provide a letter of attestation confirming that an assessment was performed if that is more appropriate for your use case.

Question 17

How do I request an assessment?

Accepted Answer

Use the contact form on our website to describe your application, environment, and any specific concerns. We will review your request and follow up to discuss scope, timeline, and approach. There is no obligation at the inquiry stage — we want to make sure an assessment is the right fit before moving forward.

Question 18

What information should I include in my initial inquiry?

Accepted Answer

A brief description of what you want assessed — the type of application, the technology stack if known, the environment (cloud provider, self-hosted), any specific concerns or areas of focus, and any constraints such as compliance requirements or upcoming deadlines. The more context you provide, the more useful our initial response will be.

Question 19

Do you work with companies outside the United States?

Accepted Answer

Yes. We work with companies regardless of location. Assessments are conducted remotely. We discuss any jurisdiction-specific considerations — such as data handling requirements or applicable regulations — during scope definition.

Question 20

What if I am not sure which assessment is right for us?

Accepted Answer

Describe your situation and we will recommend an appropriate scope. Common starting points are an application security assessment for companies with a web application or API, a cloud and infrastructure review for companies with growing cloud complexity, and a compliance readiness review for companies approaching a SOC 2 audit or enterprise sales cycle. Many engagements combine elements of more than one assessment type.

Frequently Asked Questions

General

Scope and Authorization

Assessment Process

Deliverables and Findings

Getting Started

Have a Question Not Listed Here?