Not all heroes wear capes. Some rock hoodies.

Contact us Get a quote

Trusted by 100+ organizations around the world

Nasdaq

Nasdaq

FHLB

FHLB

Fannie-Mae

Fannie-Mae

United Bank

United Bank

Evolve Bank

Evolve Bank

PenFed

PenFed

ARIN

ARIN

Mastercard

Mastercard

Unisys

Unisys

Rightworks

Rightworks

Deltek

Deltek

Blockdaemon

Blockdaemon

Hilton

Hilton

NetSPI

NetSPI

Eagle Bank

Eagle Bank

Yahoo

Yahoo

GSK

GSK

Krispy Kreme

Krispy Kreme

Sandy Spring Bank

Sandy Spring Bank

Viatris

Viatris

Veeva

Veeva

Sonatype

Sonatype

Five Guys

Five Guys

Verisk

Verisk

Nasdaq

Nasdaq

FHLB

FHLB

Fannie-Mae

Fannie-Mae

United Bank

United Bank

Evolve Bank

Evolve Bank

PenFed

PenFed

ARIN

ARIN

Mastercard

Mastercard

Unisys

Unisys

Rightworks

Rightworks

Deltek

Deltek

Blockdaemon

Blockdaemon

Hilton

Hilton

NetSPI

NetSPI

Eagle Bank

Eagle Bank

Yahoo

Yahoo

GSK

GSK

Krispy Kreme

Krispy Kreme

Sandy Spring Bank

Sandy Spring Bank

Viatris

Viatris

Veeva

Veeva

Sonatype

Sonatype

Five Guys

Five Guys

Verisk

Verisk

"For us, Stratum sets the standard. You guys are adaptable and flexible in your schedules. You’re responsive via email and communicate information well over the calls with our teams."
"Stratum did a great job on the reconnaissance and footprinting effort, which led to discoveries no other pen-tester had found."
"Stratum deserves a huge thanks from our project team. They helped us with our web application testing and fixing the issues that were found. They did it quickly, enabling us to meet tight project deadlines and safely progress with our plans."
"Thanks again to Stratum for walking the extra mile. The Stratum team’s professionalism and attitude made all the difference."
"We appreciate Stratum's efforts and willingness to work with us on the original and subsequent re-tests. Stratum’s flexibility and availability, specifically on the re-tests, allowed us to stay on schedule with the rollout of a business-critical application."
"We’ve worked with a lot of pen testers, and Stratum is by far the easiest to work with. There are always so few issues working with you guys, and Stratum is very thorough."

How We Help

AppSec ServicesWeb App Pen TestingMobile Pen TestingThick/Thin Client Pen TestingAPI Pen TestingSecure Code ReviewOpen-Source Software Analysis
Dive deeper

This assessment focuses on application-level vulnerabilities, including SQL injection, cross-site scripting, logic flaws, authentication bypass, and more. Following OWASP guidelines, Stratum employs a combination of automated and manual testing techniques tailored to the application's risk profile and technology stack. Our assessments are conducted by highly skilled professionals, ensuring thorough and precise identification of security flaws.

Basic

Designed for basic security assessments.

Automated security scan
Basic reporting
Comprehensive Scanning
Full Technical Report
Web apps with up to 4 user roles
Manual security testing
Complex workflows
Standard

Standard pen test for small to medium size organizations.

Comprehensive Scanning
Full Technical Report
Web apps with up to 4 user roles
Manual security testing
Complex workflows
Ultimate

Pen tests that include everything.

Comprehensive Scanning
Full Technical Report
Web apps with up to 4 user roles
Manual security testing
Complex workflows
NetSec ServicesExternal Penetration TestingInternal Penetration TestRed Teaming
Dive deeper

Assess the security posture if your external preventative and detective security controls. We evaluate your external-facing systems, including firewalls, web servers, and other public-facing infrastructure, for vulnerabilities that external attackers could target. Our assessment thoroughly examines open ports, exposed services, and potential misconfigurations, delivering actionable insights to secure your network perimeter against unauthorized access and cyber threats.

Basic

Basic compliance-based security assessment.

Full port scan – 65k ports
Service discovery & identification
Automated vulnerability scanning
Analysis and Reporting
Manual false positive/negative analysis
Selective vulnerability exploitation
Open Source Intelligence (OSINT) assessment
AI-powered domain name discovery & attribution
Attack surface discovery
External asset identification
External user password strength assessment
Email-based Phishing attack targeting users
Dark web data search
Standard

Standard pen test for small to medium size organizations.

Full port scan – 65k ports
Service discovery & identification
Automated vulnerability scanning
Analysis and Reporting
Manual false positive/negative analysis
Selective vulnerability exploitation
Open Source Intelligence (OSINT) assessment
AI-powered domain name discovery & attribution
Attack surface discovery
External asset identification
External user password strength assessment
Email-based Phishing attack targeting users
Dark web data search
Ultimate

Full scope external penetration test with skilled tester using all available means to compromise the target.

Full port scan – 65k ports
Service discovery & identification
Automated vulnerability scanning
Analysis and Reporting
Manual false positive/negative analysis
Selective vulnerability exploitation
Open Source Intelligence (OSINT) assessment
AI-powered domain name discovery & attribution
Attack surface discovery
External asset identification
External user password strength assessment
Email-based Phishing attack targeting users
Dark web data search

Ensure the security of your cloud environments with our detailed Cloud Security Assessments service. We evaluate the security of your cloud infrastructure, applications, and services across AWS, Azure, M365, and Google Cloud platforms. Our assessment covers identity and access management, data encryption, compliance, and configuration management. We provide a detailed report highlighting vulnerabilities and offering practical solutions to secure your cloud assets.

We offer staff augmentation services embedding our security professionals into your organization. We help to provide app, cloud, and network security support integrating with your organization’s security team.

See how we helped our clients

Managed App TestingApplication SecurityMobile Security

A force multiplier to secure a large application portfolio.

Application SecurityNetwork SecurityCybersecurity Diligence

Cybersecurity diligence that keeps pace with the speed of the deal.

Application SecurityNetwork SecurityThink Client Security

Flexible testing to meet the needs of a diverse organization.

A CREST-accredited information security consulting company based in DC supporting clients worldwide.

Stratum provides services to clients worldwide. Our list of customers include large multi-national enterprises to small start-ups in numerous industries including finance, insurance, retail, hospitality, health care, government, technology, energy, and telecommunications.

Accreditations CREST-accredited
Certifications

40+

Team size

36+

Meet your experts

Team Members

Trevor Hawthorn

Managing Partner

Team Members

Daniel Purucker

Managing Partner

Team Members

Jeff LoSapio

Managing Partner

Team Members

Andrew Minnicks

Account Director

Team Members

Nicole Smith

Principal Security Consultant

Team Members

Jared Perry

Principal Security Consultant

Team Members

You?

Open Positions

Team Members

Colin McQueen

Principal Security Consultant

Team Members

Hanny Flint

Project Manager

Team Members

Mariah Haag

Project Manager

Team Members

Adeeb Shah

Managing Consultant

Team Members

Samantha Millsaps

Business Development Manager and Recruiter

Team Members

Ken Malmquist

Senior Security Consultant

Team Members

Bucky Spires

Senior Security Consultant

Team Members

Phil Thomas

Senior Security Consultant

Team Members

Justin White

Senior Security Consultant

Team Members

Evan Pink

Security Consultant

Team Members

Evan Magrann

Security Consultant

Team Members

Jeremy Dupuis

Security Consultant

Team Members

Josh Lea

Security Consultant

Team Members

Matthew Hains

Security Consultant

Team Members

Charlie Campbell

Security Consultant

Team Members

Tom Pham

Security Consultant

Team Members

Nicholas Donarski

Security Consultant

Team Members

Chris Cerne

Security Consultant

Team Members

Jacob Riesser

Security Consultant

Team Members

Benny Himley

Security Consultant

Team Members

Justin Flowers

Security Consultant

Team Members

Ivy Baumgarten

Security Consultant

Team Members

Robert Steffes

Security Consultant

Team Members

Shane Lester

Security Consultant

Team Members

Mamadou Bah

Security Consultant

Team Members

Jordan Robinson

Security Consultant

Our Values

2005-01
Listen

Listen

2005-01

Focus completely on the person you're talking to without getting distracted. Don't worry about agreeing or disagreeing, just be curious and try to understand their point of view by listening carefully.

2005-02
Over communicate

Over Communicating

2005-02

When communicating, it's important to be clear, honest, and on the same page with everyone. This means explaining things well, keeping people updated, and ensuring everyone understands, whether with our team, clients, or partners.

2005-03
Teamwork

Being Ego-Free

2005-03

We check our egos at the door and prioritize collective success over individual recognition. At our core, we understand that true greatness is achieved when we work together selflessly, with a shared commitment to the mission and our values.

2005-04
Do what you say

Do what you Say

2005-04

It's our golden rule. It's about honoring commitments, following through on promises, and holding ourselves accountable. We believe in the power of integrity and reliability, ensuring that our actions always align with our words.

2005-05
Improve yourself

Improve Yourself

2005-05

A relentless pursuit of personal and professional growth and development. We embrace challenges, seek feedback, and continuously strive to become the best versions of ourselves. At our core lies a commitment to lifelong learning and a dedication to constant improvement in every aspect of our lives.

Get started by telling us what tests you need.

You can select multiple options depending on your needs.

Got a questions? We have answers

A: We certainly can! Stratum offers tailored packages precisely for these scenarios, providing feature release testing aligned with your release cadence. If you wish to test specific application features before they go live in production, Stratum has you covered.

A: Our pen testing reports will meet PCI-DSS, SOC 2, ISO 27001, HIPAA, and other industry standards.

A: Yes. Stratum Security not only provides a comprehensive report with step-by-step instructions on reproducing the findings, but we also schedule meetings with you and your team to ensure that each vulnerability is thoroughly understood and to provide proper guidance for remediation.

A: On average most tests take from 1-2 weeks depending on the size and complexity of your application or environment.

One aspect we take immense pride in is our ease of collaboration! We go the extra mile by setting up Slack or Teams channels for you to directly communicate with us during testing. This grants you direct access to the tester. Moreover, we are easily reachable by phone and email!

A: Stratum can conduct a secure code review on any application source code utilizing both manual and automated approaches. Our testers were formerly developers who transitioned into the realm of application security.

With access to the source code, we can pinpoint vulnerabilities in the coding structure and provide a comprehensive report. Additionally, Stratum offers services for Software Composition Analysis of third-party software, identifying risks in both direct and transitive dependencies.

A: Yes, with every Stratum Security Pen Test 1 retest is included. This will help to verify findings are fixed and close them out in the final report.

A: At Stratum, we employ a blend of manual and automated testing techniques. While scanners are valuable, manual exploitation of vulnerabilities often yields superior results, uncovering more high and critical vulnerabilities than any scanner can.

The human touch affords us control over the testing process, enabling us to attack it in a manner akin to a real hacker's approach.

A: Stratum offers staff augmentation services! We can embed application security experts, cloud security experts, and network security experts in your organization.

From program building to pen testing Stratum can handle all your security needs from within your organization.

Let’s dive in

Contact Us