Articles by Nicole Selby

Penetration testing is an exercise in trust. You’re handing a third party the means to access your systems, in many cases your source code, and the details of exactly where your product or company is vulnerable. Before you sign off on an engagement, it’s worth understanding what that trust is actually built on, and what questions you should be asking. Who is doing the work, and can you vet them? Choosing a pen test provider isn’t just deciding which company logo you want on your testing report. Testing involves specific people accessing your systems and, often, your source code. You

Penetration testing is a professional service, but for customers looking to engage a pen testing provider it sits in an awkward category of purchase. Unlike most professional services, where you can assess capability through a proposal, a reference call, provider visibility in the marketplace, or a few hours of scoped work, the quality of a pen test is genuinely difficult to evaluate before you buy it. And to some degree, it remains difficult to evaluate even after you receive the report. This is the core problem buyers face. You are commissioning work whose depth and rigour you cannot directly observe,

It’s not uncommon for teams to commission a pen test (particularly their first one) without really knowing what’s about to happen. The process can feel like a black box, which is ironic given that black box testing isn’t where you should be heading. This lack of clarity and understanding is not surprising given the technical nature of these engagements. However, it doesn’t need to be like this. In this guide, we walk you through what actually happens, from initial conversation to ongoing assurance. Our view is that an informed buyer makes better decisions and gets more from the testing experience

Since phew was founded, our focus has been on building a business grounded in quality. That meant investing heavily in how we work, developing rigorous methodologies, and holding ourselves (and our pen testing) to high standards. By delivering work we could genuinely stand behind, we prioritised substance over presentation, and outcomes over optics. Along the way, we didn’t really pause to spend time fully articulating who we are, what we stand for, and why it matters, but recently we decided it was time to address that. By undertaking a brand story exercise with the team at Flux, we’ve been able to articulate

We are delighted to announce that phew has been recognised as an approved supplier of security services on the New Zealand Government’s Marketplace, through a Collaborative Marketplace Agreement. phew has joined the Information Security Professional Services Panel alongside other approved suppliers to the Government, listed on MBIE’s procurement platform, Marketplace, under the ‘Source Code, Application Review and Technical Testing’ category. As an approved supplier, phew has completed the open primary procurement process, meaning that phew is a supplier that government agencies can confidently engage, and with whom agencies do not need to negotiate their own contract terms or pricing. Being