Applications
The surfaces we test
Network, web, API, cloud, Active Directory and embedded devices, tested as one engagement rather than six separate ones.
Surfaces
What Revelion tests
Each surface fails in its own characteristic way, so each gets its own approach inside the same engagement.
NetworkInternal and external infrastructure, lateral movement and privilege escalation.Web and web appsInjection, authentication, access control and business logic flaws.APIsREST and GraphQL, including the endpoints missing from the documentation.CloudIdentity misconfiguration, exposed storage and privilege escalation paths.Active DirectoryCredential attacks, delegation, ACL abuse and paths to domain control.IoT and embeddedConnected devices and the network position a compromised one grants.
One engagement
The surfaces are not tested in isolation
Splitting testing by surface is useful for describing coverage and misleading as a model of how attacks work. Real compromises cross boundaries: a web flaw yields a credential, the credential works on the network, the network reaches an identity system.
Revelion runs them as one engagement for that reason. The categories here describe what a mission examines, not separate products you buy individually.
One engagement covers all of it.
See how a mission runs