Skip to content

field notes · rescue

Security and pentest readiness

Security and pentest readinessAn isometric drawing of pentest readiness. A gantry scanner on two rails runs over a row of your systems: a web app with a browser window, a cloud setup drawn as a cluster of puffs, access controls as a rack of keys, and an AI feature as a chat box with a speech bubble. Scan rolls the gantry along the row and raises vermilion flags on what it finds, taller for the findings that would hurt more. Fix next sends your team to the tallest flag; it comes down and a tick confirms the fix stuck. Try prompt injection sends a token at the chat box: before the AI feature is fixed, sheets of data leak out of the back; after, the token is turned back. When every flag is down, the testers' door at the end of the rails opens beside a scope sheet and test account badges, ready to book.web appcloud setupaccess controlsai featuretaller flag, bigger hurt1234567

Your systems in a row: web app, cloud setup, access controls and an AI feature. Press scan.

Obvious holes fixed before your pentest, so testers chase the hard ones.

Book a free first callEstimate the cost

In short

Pentest readiness is the security work done before a formal penetration test, so the test finds subtle problems instead of obvious ones. It's for New Zealand businesses facing a customer, investor or compliance pentest, especially ones with AI features. Zenoware, an Auckland studio, reviews your apps and cloud setup, ranks what it finds, helps your team fix it, checks LLM features for prompt injection and gets scope and access ready for the testers. It starts with a free first call.

What you get

  • Known vulnerabilities fixed before the testers turn up

  • AI features checked for prompt injection and data leaks

  • A scoped, documented pentest that's ready to book

How it runs

  1. 01

    Assess

    We go over your apps, cloud setup and access controls, and list what matters most.

  2. 02

    Scan and triage

    Automated and manual scans, with findings ranked by how much they'd actually hurt you.

  3. 03

    Fix

    Your team makes the fixes with our help, and we check each one stuck.

  4. 04

    Prepare

    Scope, test accounts, documentation and who-to-call contacts, agreed with the testers.

Who you'll work with

Brush sketch of JP Caparas

JP Caparas

Founder and lead engineer

Thirteen years of principal engineering, including development lead at Public Trust. OpenAI Codex and Devin ambassador in New Zealand. You talk to the person who writes the code.

About the team

Questions

What is a pentest readiness review?

A security check before the formal penetration test. Scans, a configuration review and fixes clear out the issues a scanner would find anyway, which means the testers you're paying spend their time on the subtle problems that need a person to spot.

What is the difference between a vulnerability scan and a penetration test?

A vulnerability scan is automated (a tool checks for known flaws and misconfigurations). A penetration test is people trying to get in, chaining small weaknesses together the way a real attacker would, then telling you how far they got.

How do I prepare for a penetration test?

Agree the scope in writing and fix what you already know is broken. Set up test accounts, tell your hosting provider if their policy wants notice, and name someone testers can call if something falls over. Take fresh backups before they start.

What is a prompt injection attack?

Text that talks an LLM into ignoring its instructions. A user might type it, or it might be hidden in a document or web page the model reads. It can leak data or trigger actions, so keep the model's permissions narrow and treat whatever it outputs as untrusted.

Do you run the penetration test itself?

We get you ready and help with scoping. The formal test is normally done by an independent tester, and we line up the documentation, access and contacts they'll need so they can start on day one.

You might also need

Tell us what isn't working.

The first call is free, and we'll tell you straight whether we're the right people for it.

Start a project