Drawn from observation.
Portolan charts were the working maps of medieval navigators: drawn from first-hand observation rather than theory, and criss-crossed with rhumb lines connecting every point to every other. That is how we map your attack surface — from what we actually verified, with the lines between findings drawn in.
One accountable expert
Portolan Sec is founder-led. The person on your scoping call performs the testing, writes the report and answers your questions afterwards. Nothing is handed to juniors or subcontracted.
Evidence over opinion
Every finding is verified and reproducible. You get the request, the response, the line of code — not a scanner's guess. False positives are removed before you ever see them.
Context over checklists
A missing header on a marketing site and on a banking API are not the same risk. Severity starts with CVSS, and you can adjust it to your environment in the portal.
Five steps, fully visible in your portal.
- 01
Scope
A call to understand your system, your threats and your constraints. You get a written scope and rules of engagement.
- 02
Assess
Hands-on testing or review. Critical findings are published to your portal as soon as they are confirmed.
- 03
Chain
Findings are linked into attack paths so you see which weaknesses enable the most damaging ones.
- 04
Report
Executive summary, technical detail and remediation guidance — in the portal, as PDF and through the API.
- 05
Retest
Once you have fixed, we verify. Status and history stay in the portal for your auditors.
A common language for risk.
Findings are scored with the Common Vulnerability Scoring System v4.0 (v3.1 on request), classified with CWE and mapped to the OWASP Top 10 or ASVS requirement they violate, so they fit straight into your existing risk register.
Where a score depends on something we could not verify — code that was not provided, how a service is deployed — we score the reasonable worst case and say so: each finding states what its rating assumes and how confident we are.
In the portal, you can apply CVSS environmental metrics — how critical the affected asset's confidentiality, integrity and availability are to you, and which compensating controls already exist — to correct an assumption that does not hold for you. The adjusted score is shown next to ours and carried into the PDF report.
| Severity | CVSS | Meaning |
|---|---|---|
| critical | 9.0 – 10.0 | Trivially exploitable with severe business impact. Fix immediately. |
| high | 7.0 – 8.9 | Significant impact or likely exploitation. Fix as a priority. |
| medium | 4.0 – 6.9 | Exploitable under specific conditions. Plan remediation. |
| low | 0.1 – 3.9 | Limited impact. Fix during regular maintenance. |
| info | 0.0 | Observation or hardening advice without direct risk. |
Your decision, on the record.
Not every finding gets fixed, and that is fine — as long as the decision is deliberate. For each finding you choose a treatment and document why. The history is kept for your auditors.
Mitigate
Fix it, or add compensating controls that reduce likelihood or impact.
Accept
Knowingly keep the risk, with a documented business justification.
Transfer
Share it with a third party such as an insurer or a provider contract.
Avoid
Remove the exposure entirely, e.g. by retiring the affected feature.