ABIR Networks, Astra Security, Halo Security and Red Sentry

About Astra Security

Astra Security sells a platform that performs continuous offensive pentests across apps, APIs and cloud. Astra Security is a penetration testing company in Delhi that specializes in protecting websites and businesses online. Astra Security's VAPT services cover websites, web apps, mobile apps, cloud infrastructure, network devices and emerging technologies like blockchain. Astra Security finds vulnerabilities and verifies the fixes that the customer's team implements.^[1][3][4][5]

Astra Security offers a PTaaS (Penetration Testing as a Service) platform. Astra Security's continuous pentesting combines automated scanning with expert manual assessments. Astra Security's continuous pentesting covers every new feature a customer builds. Astra Security runs manual pentests in 8-15 business days. Astra Security provides two re-scans to validate fixes and a publicly verifiable certificate once a customer passes the pentest. Astra Security's pentest reports include video PoCs and detailed steps to fix a vulnerability. Astra Security issues publicly verifiable certifications with shareable links.^[1][3]

Astra Security offers a DAST scanner and an API security platform. Astra Security's vulnerability scanning covers CVEs and access control flaws. Astra Security's authenticated scans scan behind login screens. Astra Security's scanning offers CI/CD, Slack and Jira integrations. Astra Security lets customers share continuous scan results and security posture with the Trust Center. Astra Security's API scanning looks for shadow APIs, zombie APIs and broken access control.^[1][3]

Astra Security's cloud scanning is continuous, agentless and multi-cloud. Astra Security's cloud scanning detects 400+ misconfigurations and risks across AWS, Azure and GCP. Astra Security's cloud scanning integrates into CI/CD for checks before and after every deployment. Astra Security provides shareable cloud security evidence through the Astra Trust Center.^[3]

Astra Security examines every AI-driven component in a customer's app. Astra Security's AI testing covers prompt-based attacks such as jailbreaks, indirect and context injection, and context poisoning. Astra Security's AI testing includes CVE reproduction testing, such as Redis bugs, SSRF and exposed configs. Astra Security's team has discovered and responsibly disclosed 50+ CVEs. Astra Security's pentesters hold OSCP, CEH, eJPT, eWPTXv2 and CCSP (AWS) credentials. Astra Security is a CREST-approved member, CERT-In empanelled, a PCI ASV-approved scanning vendor and ISO 27001-certified.^[8]

Astra Security sells penetration testing security to insurance providers. International SOS is a global health and security services organization. International SOS selected Astra Security for a platform-driven approach to penetration testing that blends automation with manual expertise. SmartWinnr is a mobile-first sales productivity platform for remote sales teams. Astra Security scanned SmartWinnr's web, iOS and Android applications and AWS infrastructure. Astra Security's team conducted 1 security audit for ZenoCloud.^{[9][10][11][12]}

About Halo Security

Halo Security sells penetration testing and continuous visibility across an attack surface, bringing testing, discovery, and scanning together. Halo Security tests web and mobile applications, APIs, external and internal networks, and wireless environments. Halo Security offers social engineering and red teaming. Halo Security's penetration testing service combines manual investigation with tools whose results are validated by testers.^[1][2][3]

Halo Security's ethical hackers explore how an attacker could get in, what they could reach, and how to close the gap. Customers work directly with US-based experts at Halo Security. Halo Security includes one round of retesting so customers can verify their remediation work. Halo Security provides reports and attestation letters that give a customer's team, auditor, and prospects evidence of its security. Halo Security reports support SOC 2, HIPAA, PCI, and other compliance needs.^[1][2]

Attack surface management helps organizations discover and monitor the assets they expose to the internet, including websites, APIs, servers, and cloud services. Halo Security continuously checks those internet-exposed assets for vulnerabilities and changes. Halo Security finds and inventories internet-facing assets, including unknown and forgotten websites, IPs, services, and applications. Halo Security identifies open ports and internet-facing services so customers can monitor changes. Halo Security tracks certificates, security headers, third-party scripts, and other security controls across websites. Halo Security detects known vulnerabilities, missing security patches, and outdated software across external servers. Halo Security scans web applications for vulnerabilities such as SQL injection and cross-site scripting. Halo Security monitors for leaked employee credentials, exposed data, and mentions of an organization on the dark web. Halo Security can identify issues like subdomain takeovers, domains for sale, forgotten projects, and misconfigured cloud services. Halo Security risk scores show the external security posture of different teams and business units.^{[1][2][4][5][11]}

Halo Security is a PCI Security Standards Council Approved Scanning Vendor, and its certificate number is 5078-01-11. Halo Security customers can set scans to run daily, weekly, monthly, quarterly, or on-demand. Customers with multiple business units can generate separate reports in the Halo Security portal. Halo Security scans look at an organization from the outside, with nothing to install and nothing to configure.^[6][7]

Halo Security connects to AWS to import assets from Route53, ElasticIP, and Elastic Load Balancer. Halo Security creates and tracks security issues in Jira, and it streams security events and findings into Splunk. Halo Security syncs security findings with Vanta for compliance monitoring and reporting, and it sends real-time security alerts to a Slack workspace. Brinqa ingests external attack surface findings directly from the Halo Security platform. Halo Security also runs a Security Review, offered quarterly or semi-annually, in which its team works with customers to identify gaps in their coverage.^[8][9][10]

The Halo Security platform helps organizations of all sizes achieve PCI compliance. In 2013, the operation was spun out to form PathDefender, which was shortly thereafter rebranded as TrustedSite. In 2022, the TrustedSite Security services were rebranded as Halo Security, and the TrustedSite brand remains for certification and marketing solutions. Halo Security has a team of over 30 people. Halo Security was originally based in San Francisco and now offers fully remote working opportunities.^{[1][5][6][7][10][11]}

About Red Sentry

Red Sentry sells offensive security services, from one-off penetration tests to ongoing PTaaS (Penetration Testing as a Service) partnerships. Red Sentry supports web application, API, network, cloud, compliance-focused, and PTaaS engagements. Red Sentry combines tooling with human-led testing to uncover business logic, chained vulnerabilities, and real-world exploit paths. The core penetration testing from Red Sentry covers web, network, and cloud assets to meet SOC 2 and ISO standards. For mature security teams, Red Sentry offers advanced Red Teaming and adversary simulation.^[1][3][5][6]

Red Sentry assesses iOS and Android apps for flaws such as insecure data handling, API abuse, and authentication bypasses. In web application penetration testing, Red Sentry attempts to view other users' data (IDOR) or escalate privileges to Admin status by manipulating requests. Red Sentry source code review pairs tool-assisted static analysis with manual security review and validation. Red Sentry offers source code review as a standalone service. Red Sentry may support additional languages, including Solidity, Scala, and Perl, in source code reviews, depending on scope, technology, and reviewer availability.^[5][7]

For infrastructure, Red Sentry tests public-facing IPs and services without credentials in external network testing. Red Sentry simulates threats originating from stolen credentials, insider threats, or compromised devices. In cloud testing, Red Sentry combines configuration review with active exploitation. Red Sentry physical security assessment tests whether physical controls, people, and processes prevent unauthorized access to agreed locations and objectives. Red Sentry offers the physical security assessment as a standalone service.^[8][9]

Red Sentry describes a Red Team Operation as a simulated full-scale attack that tests an organization's people, processes, and technology. Red Sentry follows the MITRE ATT&CK framework to simulate the entire lifecycle of a breach. Red Sentry red teams collaborate with the Blue Team to explain exactly how controls were bypassed. Red Sentry social engineering campaigns measure a team's security awareness by simulating the tactics used by ransomware gangs and APT groups. Red Sentry runs phone-based attacks to test staff handling of sensitive info. Red Sentry social engineering reporting includes a breakdown of who opened, who clicked, and who submitted data.^[10][11]

Red Sentry delivers its work through a PTaaS platform. PTaaS means penetration testing as a service, and it gives teams a central place to track findings, remediation, retesting, communication, and report delivery. Every Red Sentry engagement includes full access to the PTaaS platform at no extra cost. Red Sentry portal access lets teams track project status, access reports and evidence, communicate with the project team, and manage remediation. Red Sentry reports include clear reproduction steps, often with video or screenshots. Red Sentry manually validates reported findings and demonstrates exploitability where appropriate.^{[1][3][5][6][12]}

Red Sentry includes one round of remediation testing for source code review findings when requested within 90 days of report delivery. Red Sentry makes one round of remediation testing available for API testing findings when requested within 90 days of report delivery. In network testing, Red Sentry verifies fixes and does not charge extra to double-check its work. Red Sentry physical assessments do not include remediation testing by default.^{[2][6][7][9][13]}

On compliance, Red Sentry maps every finding directly to the audit framework of the client. Red Sentry helps organizations work out which assessments their SOC 2 environment needs, then runs them by hand from scoping to final report. Red Sentry reports include an executive summary, full technical findings mapped to Trust Services Criteria, reproducible steps, prioritized remediation guidance, a Letter of Attestation when applicable, and one complimentary retest. Red Sentry locks scope and pricing before testing starts. Red Sentry offers specialized testing to secure Cardholder Data Environments (CDE). Red Sentry provides technical testing and supporting evidence, and the client's auditor determines compliance.^{[1][6][9][12][14]}

Red Sentry has completed a SOC 2 Type II examination conducted by an independent CPA firm. Red Sentry testers hold certifications such as OSCP, CISSP, CREST, and CCSP.^{[3][5][6][7][9][10][11][12][14]}