Operator
All engagements, contracts and invoices are with Syber, and "we" and "us" on this site mean Syber.
Scope
Syber's agents test for the kinds of weaknesses that show up on real production apps and APIs: broken access control, injection, authentication and session weaknesses, server-side request forgery, business-logic flaws, exposed secrets and the logic flaws behind regulated flows. Coverage grows with every engagement. Programs are delivered monthly, with the final scope agreed per engagement.
- Baseline assessment: a one-time, roughly 90-minute run against a domain you own. Free.
- Continuous penetration testing: always-on testing, with a proof-of-concept per finding, a proposed fix your team ships, and retests after changes.
- Compliance program: continuous testing plus red teaming, with evidence packaged for SOC 2, ISO 27001, PCI DSS, HIPAA and DORA audits, and licensed partners where an audit requires one.
- Targeted assessment: a deeper, scoped engagement against a specific feature, surface or release candidate.
Authorization
Syber tests only surfaces you control. The booking flow requires that the email used to request a baseline assessment shares the registrable domain with the site being tested, which is a simple first check of authorization. For continuous and targeted work, a signed scope document supersedes that check. Syber does not scan, probe or poke at anything outside the scope you gave it, does not pivot through your infrastructure to reach third parties, and does not exfiltrate user data. When an agent needs to confirm a finding, it takes the smallest possible proof, then stops.
What Syber will not do
- No denial-of-service testing without explicit, written, change-controlled approval.
- No social engineering of your team unless contracted under a separate red-team agreement.
- No physical or wireless testing.
- No persistent backdoors, no implants, no "just in case" access.
- No code or configuration changes shipped to your production systems on an agent's own authority. Syber proposes the fix, your team approves and ships it, and Sentry retests.
Findings and disclosure
Every finding is yours. You get the report, the proof-of-concept, the remediation guidance and the raw evidence trail, whether or not you continue with Syber. Syber does not sit on bugs, does not sell findings to anyone, and does not publish or name you without written consent.
Data Syber touches during testing
In the course of testing, Syber may incidentally encounter your data, such as URLs, response bodies and error pages. Syber treats all of it as confidential, stores only what is required to reproduce findings, and purges it on the schedule set in your engagement contract. See the privacy policy for the detail.
Payment and cancellation
Baseline assessments are free. Paid programs are scoped per engagement. You can cancel any continuous engagement with 30 days' notice, and findings already delivered are yours to keep.
Get in touch
Get a free assessment, book a demo, or email team@syber.sh.