External penetration tests with a defined scope and findings you can act on
For CISOs and IT and engineering teams that need clear technical documentation: what was tested, which weaknesses were found, whether each finding was validated and what stayed out of scope.
| Finding | Severity | CVSS score | Retest |
|---|---|---|---|
| F-01 | High | 7.1 | Fixed |
| F-02 | Medium | 6.1 | Fixed |
| F-03 | Medium | 5.3 | Not fixed |
| F-04 | Low | 3.1 | Inconclusive |
| F-05 | Info | No score | Fixed |
Test scope
Before testing we agree in writing on the targets, user types, test window, working constraints and stop conditions. The default is an external test of explicitly approved targets. Anything beyond the scope needs separate approval.
MEIDAY runs autonomous AI-based testing and goes over the report before delivery. Findings are validated by hand only with the add-on, by an OSCP-certified tester. The service is not presented as an automated replacement for a full manual penetration test or for a dedicated regulatory assessment.
In scope
- Public targets listed in the quote: domains, subdomains and external services you have proper authorization to test
- The web application and its APIs, as part of the same system
- Authenticated testing with test users for each in-scope user type, up to 2 types in the standard package
- Tests configured to avoid destructive actions and service outages, in the agreed time window and rate
Out of scope unless agreed
- Source code review or software dependency analysis with internal access
- Internal network, VPN and endpoints
- Cloud account configuration review
- Privilege escalation beyond the defined user types
- Social engineering, phishing and red team exercises
- Load and denial-of-service testing
- Third-party systems you are not authorized to test
Quality control and finding validation
Every finding is reported with the evidence collected. A finding reproduced by hand with the OSCP add-on is marked in the report, so your technical team knows what was detected automatically and what a tester validated.
| Stage | What happens | What it means for you |
|---|---|---|
| Automated detection | Autonomous AI-based testing tools run the test and flag possible findings. | A finding at this stage has not been validated by hand yet. |
| MEIDAY report check | Before delivery we go over the report to check that everything looks right. | The check is part of the service. Findings are not validated or reproduced one by one. |
| Manual reproduction by an OSCP tester | Paid add-on: an OSCP-certified tester tries to reproduce each finding by hand, up to 10 per system, within the agreed scope. | The report records which findings were checked by hand and the result, including cases that could not be reproduced. |
The report check is a general check before delivery. It does not validate the findings, it is not a certification of the system or the report, and it does not replace a comprehensive manual penetration test. The OSCP add-on is also limited to the findings selected for reproduction; it does not retest the whole system.
What each finding contains
Severity and a CVSS 3.1 score, the exact component, evidence with sensitive values redacted, reproduction status, business impact, the recommended fix and a CWE classification. A proof of concept only when it can be shown without putting the system at risk.
Methodology and limitations
Findings are classified by CWE and rated with CVSS 3.1 where a rating fits. The report gives you data for prioritizing and tracking, along with the business and technical context of each finding.
The report does not claim full OWASP Top 10 coverage or compliance with a particular testing standard. Autonomous testing can find known technical weaknesses but may struggle with business-logic flaws that need a deep understanding of the process. The report states what was and was not tested.
If a regulator, auditor or customer requires a test in a specific format or by a tester with a specific certification, send us the requirement before ordering. We will tell you whether the report fits.
Approval process
Scope document and written authorization
The target list, user types and schedule, and confirmation from an authorized person in your organization that each target may be tested.
Rules of engagement and test users
Time window, test rate, a contact who can stop the test immediately, and what happens if we come across sensitive data. A dedicated account for each user type, never employee accounts. The IP addresses we test from change from one test to the next, and can also change during a test if they get blocked. We give you the addresses with the report, or earlier if you ask.
Test and report
Testing runs only inside the approved window. The report is sent encrypted to the named contacts, through the channel you chose.
Complex scopes
Multiple systems, more than 2 user types, many integrations or several environments need a detailed scoping. We review the scope and send a written quote with the matching deliverables and terms.