- Penetration Testing
Pentesting as a Service
- Find, validate, and fix vulnerabilities on your web, mobile, and thick applications.Find, validate, and fix vulnerabilities on your AWS, Azure, Google, and Oracle cloud infrastructures.
- Find, validate, and fix vulnerabilities on your internal, external, wireless, and host-based networks.Build a mature security program with AppSec as a Service, program assessments, and threat modeling.
- Perform red and purple team, assumed breach, ransomware, and detective control assessments.Find application security vulnerabilities earlier in your SDLC with SAST, SCR, triaging, and remediation validation.
- Resources
- Read the latest business insights from our thought leaders.Infographics, ebooks, checklists, and more.
- Vulnerability and testing insights from our technical experts.Hear from leaders in the industry.
- Security tools for everyone.Learn from NetSPI’s technical and business experts.
- Your resource for SQL Injection vulnerabilities.
-
Ryan Wakeham
Ryan Wakeham has been with NetSPI since 2005 and has nearly 20 years of IT and cyber security experience. He holds a graduate degree in Information Security from the Georgia Institute of Technology and has a background that includes vulnerability testing, compliance advisory consulting, and security management program assessment & development. Over his years with NetSPI, Ryan has worked with clients ranging from Fortune 10 organizations and top US financial institutions to multinational retailers and global technology companies. For several years, Ryan led NetSPI’s pentesting team. In his current role, Ryan partners with NetSPI’s clients to better understand their security challenges and develop solutions to meet their needs.
September 22nd, 2013
The Value of Detective Controls
For as long as I can remember, security professionals have spent the majority of their time focusing on preventative controls. Things like patching processes, configuration management, and vulnerability testing all fall into this category. The attention is sensible, of course; what better way to mitigate risk than to prevent successful attacks in the first place? […]
December 12th, 2012
2013 Cyber Threat Forecast Released
The Georgia Tech Information Security Center and Georgia Tech Research Institute recently released their 2013 report on emerging cyber threats. Some of these threats are fairly predictable, such as cloud-based botnets, vulnerabilities in mobile browsers and mobile wallets, and obfuscation of malware in order to avoid detection. However, some areas of focus were a bit […]
October 15th, 2012
Thoughts on Web Application Firewalls
I recently attended a talk given by an engineer from a top security product company and, while the talk was quite interesting, something that the engineer said has been bugging me a bit. He basically stated that, as a control, deploying a web application firewall was preferable to actually fixing vulnerable code. Web application firewalls […]
June 22nd, 2012
Web Application Testing: What is the right amount?
It is becoming more common these days (though still not common enough) for organizations to have regular vulnerability scans conducted against Internet-facing, and sometimes internal, systems and devices. This is certainly a step in the right direction, as monthly scans against the network and service layer are an important control that can be used to […]
May 24th, 2012
Enterprise Vulnerability Management
Earlier this month, at the Secure360 conference in St. Paul, Seth Peter (NetSPI’s CTO) and I gave a presentation on enterprise vulnerability management. This talk came out of a number of discussions about formal vulnerability management programs that we have had both internally at NetSPI and with outside individuals and organizations. While many companies have […]
March 19th, 2012
Pentesting the Cloud
Several months ago, I attended an industry conference where there was much buzz about “The Cloud.” A couple of the talks purportedly addressed penetration testing in the Cloud and the difficulties that could be encountered in this unique environment; I attended enthusiastically, hoping to glean some insight that I could bring back to NetSPI and […]
February 7th, 2012
The Annual Struggle with Assessing Risk
In my experience, one of the security management processes that causes the most confusion among security stakeholders is the periodic risk assessment. Most major information security frameworks such as ISO/IEC 27002:2005, the PCI Data Security Standard, and HIPAA, include annual or periodic risk assessments and yet a surprising number of organizations struggle with putting together […]
October 26th, 2011
Why I Hate The Cloud
The Cloud is one of the “new big things” in IT and security and I hate it. To be clear, I don’t actually hate the concept of The Cloud (I’ll get to that in a minute) but, rather, I hate the term. According to Wikipedia, cloud computing is “the delivery of computing as a service […]
October 12th, 2011
Mobile Devices in Corporate Environments
Mobile computing technology is hardly a recent phenomenon but, with the influx of mobile devices such as smartphones and tablet computers into the workplace, the specter of malicious activity being initiated by or through these devices looms large. However, generally speaking, an information security toolkit that includes appropriate controls for addressing threats presented by corporate […]
Need a Quote?
Common Questions
What is Penetration Testing as a Service (PTaaS)?
PTaaS is NetSPI’s delivery model for penetration testing. It enables customers to simplify the scoping of new engagements, view their testing results in real time, orchestrate faster remediation, perform always-on continuous testing, and more - all through the Resolve™ vulnerability management and orchestration platform.
Learn More 
Why should I use NetSPI?
Your attack surface is constantly evolving. We help organizations defend against real-world attacks by being the best at simulating real-world, sophisticated adversaries with the products, services, and training we provide. Our historical testing data shows that there is simply no replacement for human-led manual deep dive testing. This level of testing finds the most severe vulnerabilities that tools will never uncover. Our proven methodology ensures that the client experience and our findings aren’t only as good as the latest tester assigned to your project. That consistency gives our customers assurance that if vulnerabilities exist, we will find them. In addition, our Resolve platform delivers automation to ensure our people spend time looking for the vulnerabilities that tools miss. We provide automated and manual testing of all aspects of an organization’s entire attack surface, including external and internal network, application, cloud, and physical security. We know how attackers think and operate, allowing us to help our customers better defend against the threats they face daily.