# Secure Ideas > Secure Ideas is a CREST-accredited penetration testing and information security consulting firm based in Jacksonville, Florida, known by its Professionally Evil brand. Engagements are delivered by experienced consultants using a manual, methodology-driven approach. This file contains the full descriptive content of the site's primary pages for language models. ## About Secure Ideas Secure Ideas has performed security testing since 2010. The team is made up of consultants who each bring at least ten years of IT experience, and instructors with more than two decades of experience across penetration testing, software development, open source, and Active Directory infrastructure. The company is CREST-accredited and a signatory of the CREST AI Charter. Its main office is at 3412 Kori Rd., Jacksonville, Florida 32257, USA, and it can be reached at 866.404.7837. Three principles guide how Secure Ideas works. Integrity: the company operates within well-defined rules of engagement, applicable laws, and client privacy on every engagement. Quality: an automated scan is never passed off as a penetration test, and testing reflects the technology and the current threat landscape. Partnership: the relationship continues past the report, with follow-up conversations, feedback, and questions welcomed year-round. ## Services ### Penetration Testing Source: https://www.secureideas.com/penetration-test Secure Ideas performs penetration testing across networks, web applications, APIs, mobile applications, wireless, and physical environments, along with red team and purple team engagements. Network testing covers internal and external scanning of networks, workstations, and systems to identify vulnerabilities and exposure points, followed by detailed recommendations. Red team engagements simulate real-world attacks to test an organization's preparedness and response. Purple team engagements combine the testing team with an organization's existing defenders so the two groups can collaborate on improving detection and response. ### Web Application Penetration Testing Source: https://www.secureideas.com/web-application-penetration-testing Secure Ideas performs in-depth, manual testing of web applications to uncover security weaknesses. Consultants scope the engagement with the client, then identify and demonstrate vulnerabilities across the public-facing aspects of the web application using a range of tools and techniques. Testing can be tailored to internal requirements or to an industry standard. ### API and Mobile App Penetration Testing Source: https://www.secureideas.com/api-and-mobile-app-penetration-testing API and mobile application testing uses a risk-based approach to analyze and test an application's architecture, implementation, and controls. Modern web and mobile architectures share a close relationship with APIs, so Secure Ideas can test one, the other, or both at once. An API penetration test focuses on the backend logic of the servers and the API endpoints, sending varied requests to observe responses, reviewing documentation for weaknesses, and attempting access with unauthorized credentials. Mobile testing gives developers and administrators information about vulnerabilities that can be addressed before an app is released. Each engagement is tailored to the client's goals, whether the concern is an outside attacker reaching sensitive data and functionality or a comprehensive test of API functionality. ### Continuous Penetration Testing Source: https://www.secureideas.com/continuous-penetration-testing Continuous penetration testing lets an organization test and evaluate its security measures on an ongoing basis rather than at a single point in time. Because traditional penetration testing of web applications and APIs does not fit neatly into the earlier stages of the software development lifecycle (SDLC), this offering supports shifting security earlier in the process, where issues can be found and addressed sooner. ### Physical Penetration Testing Source: https://www.secureideas.com/physical-penetration-testing Physical penetration testing evaluates physical controls and the awareness and procedures of staff. Consultants use techniques such as reconnaissance, social engineering, RFID cloning and fuzzing, lock bypass, and dumpster diving to attempt unauthorized access to offices, business areas, and data centers. Scoping starts with the goals of the test and an inventory of assets, locations, and related controls, which together drive the effort estimate. Pricing is based on estimated effort and a daily rate. Some controls require off-hours testing, which incurs an additional fee. ### Penetration Testing Methodology Source: https://www.secureideas.com/knowledge/secure-ideas-penetration-testing-methodology Secure Ideas applies a consistent, industry-standard methodology built on four steps: reconnaissance, mapping, discovery, and exploitation. The process is cyclical. During discovery, information from earlier steps guides both automated tools and manual testing to find common and less common vulnerabilities. During exploitation, the team determines the actual risk a vulnerability presents rather than simply noting that it exists, and post-exploitation activity often reopens reconnaissance, mapping, and discovery. When several vulnerabilities point to similar results, exploitation is limited to the minimum needed to demonstrate risk. Secure Ideas does not exploit Denial of Service vulnerabilities without prior written permission. A detailed copy of the methodology is available to download. ### Consulting and Advisory Services Source: https://www.secureideas.com/consulting-advisory Secure Ideas offers consulting and advisory services that assess an organization's existing security and recommend ways to reduce the risk of a data breach. The current solutions include InfoSec Advisory, Cybersecurity Tabletop Exercises, and PCI DSS Security work. InfoSec Advisory is delivered through the Advisory Tier of Professionally Evil Testing as a Service (PETaaS) and provides expert insight, technical consulting, and actionable recommendations. Cybersecurity Tabletop Exercises evaluate an organization's readiness and collaboration during a simulated cyber crisis, strengthening the crisis management plan through active participation. PCI DSS Security work helps organizations meet Payment Card Industry Data Security Standard requirements through ASV and QSA services. ### Security Assessments Source: https://www.secureideas.com/security-assessment Security assessments evaluate which controls are in place, whether they work as intended, and whether they meet the requirements for the system. Solutions include Foundational Gap Analysis, Architecture Reviews, Cloud Reviews, and PCI DSS QSA Services. Foundational Gap Analysis evaluates current controls against a target standard through staff interviews and a review of IT systems, then reports gaps and practical next steps. Architecture Reviews examine each component of an environment, its design, and its controls to give a fuller view than a penetration test alone. Cloud Reviews provide an in-depth analysis of weaknesses and vulnerabilities in a cloud installation. ### PCI DSS Security (QSA) Source: https://www.secureideas.com/pci-qsa Professionally Evil Practically Secure is the Secure Ideas PCI practice, led by Jeff Man. It provides QSA-led PCI DSS Security assessment services. ### Expert Witness Services Source: https://www.secureideas.com/expert-witness-services Secure Ideas provides expert witness services in cybersecurity and information technology, delivering authoritative analysis and testimony for legal matters. The team consists of seasoned experts with experience across a range of legal scenarios. ### Training Source: https://www.secureideas.com/training Professionally Evil Training offers intensive classes, lectures, and webinars for professionals of all skill levels, taught by instructors with deep experience across penetration testing, software development, open source, and infrastructure. Options include live and recorded courses, both virtual and in person, as well as tailored corporate training through a corporate training catalog. Secure Ideas offers a pay-what-you-can pricing model to widen access to quality training and help close the cybersecurity skills gap, and courses can support certification and CPE needs. ### CISSP Mentorship Program Source: https://www.secureideas.com/cissp-class The CISSP Mentorship Program is a pay-what-you-can program that prepares participants for the CISSP exam. ## Products ### Professionally Evil Testing as a Service (PETaaS) Source: https://www.secureideas.com/professionally-evil-testing-as-a-service PETaaS is structured into three connected offerings: Advisory Services, Continuous Penetration Testing, and Flexible Test Credits. Clients reach real penetration testers for advice through multiple channels, including a portal, Slack, email, Meet, or a conference platform, before, during, and after an engagement. Credits and pre-arranged contracts streamline procurement so testing can be engaged quickly when it is needed. During an engagement, clients are kept informed of issues, critical vulnerabilities, and indicators of compromise as they arise. Onboarding is handled through a Master Service Agreement that can be downloaded, reviewed, and e-signed. ### Threat Exposure Management Source: https://www.secureideas.com/dark-web-monitoring Threat Exposure Management is a subscription that continuously monitors the dark web for a client's personal or company data, such as email addresses, passwords, financial information, and other sensitive data. Secure Ideas uses Flare to perform the monitoring, sends an alert when information is found, and provides a monthly report detailing what surfaced, including leaked staff passwords. A free preliminary domain snapshot is available, reporting the number of hosts matching a domain, identified vulnerabilities, exposed services, and leaked credential alerts. Pricing is based on the number of identifiers (domains and subdomains, people, keywords, or IP addresses) in bundles, available as a 12-month subscription or a single point-in-time review. ### CloudScout Source: https://www.secureideas.com/cloudscout CloudScout runs against an Amazon Web Services (AWS) account and reports vulnerabilities and misconfigurations within the deployment, measuring the account against industry best practices. ### NetworkScout Source: https://www.secureideas.com/networkscout NetworkScout is a subscription service for asset discovery and vulnerability assessment. It builds a reliable inventory of the systems and services on a network by running daily host discovery scans, so unauthorized devices or changes can be detected, and it adds a human component to vulnerability scanning. ### WebScout Source: https://www.secureideas.com/webscout WebScout provides security assessment of web applications and APIs, performed on a regular basis and as part of the software development lifecycle (SDLC). ## Resources ### Knowledge Center (FAQ) Source: https://www.secureideas.com/knowledge The Knowledge Center answers common questions about penetration testing, including methodology, scoping, tools, and the factors that influence cost for web application, API, and network engagements. ### Blog Source: https://www.secureideas.com/blog The blog publishes technical articles and research from the Secure Ideas team across topics such as web, mobile, API, network, cloud, and Active Directory testing. ### What is Penetration Testing Source: https://www.secureideas.com/what-is-penetration-testing A primer on penetration testing concepts and engagement types, including network, web application, mobile, API, red team, purple team, and physical testing, and how testing helps an organization understand real-world risk. ### Pricing Source: https://www.secureideas.com/knowledge/how-much-does-a-penetration-test-cost An overview of how engagements are scoped and priced. The online pricing calculator is currently unavailable while it is being improved, so quotes are provided directly through the contact page. ### Webcasts Source: https://www.secureideas.com/webcast Recorded and upcoming webcast sessions from Secure Ideas. ### Podcasts Source: https://www.secureideas.com/podcasts Secure Ideas podcast content. ### Events Source: https://www.secureideas.com/events Conferences and events where Secure Ideas appears. ## Company ### Our Team Source: https://www.secureideas.com/our-team The consultants and staff behind Secure Ideas. ### Contact Source: https://www.secureideas.com/contact The starting point for scoping an engagement or requesting a quote. ### Partner Program Source: https://www.secureideas.com/partner-program Information for referral and channel partners. ### Newsletter Source: https://www.secureideas.com/newsletter Sign up for Secure Ideas updates. ### Client Portal Source: https://portal.secureideas.com/ Secure access for active clients. ### Privacy Policy Source: https://www.secureideas.com/privacy-policy How Secure Ideas handles data and privacy.