Artifice Security

Artifice Security tests whether an organization's networks, applications, devices and staff can withstand a real attack. It describes itself as veteran-owned and as a top-rated firm whose tests are carried out only by senior consultants. Its own site says the company works from Denver and serves enterprise clients across the United States.

Testing that goes past automated scanners

Each test is performed by hand, and the firm says this is what separates it from tools that only run automated scans. Its web application testing aims to go beyond the OWASP Top 10, looking for uncommon flaws in applications and their APIs, and uses internal research to find deep technical weaknesses.

Network testing is run from outside and inside the network, simulating attacks to show what the risks mean for the organization. Cloud testing covers the main public cloud platforms and includes a review of how each cloud environment is configured.

Attacks on people as well as systems

The firm tests how staff respond to spear-phishing emails, to voice calls, and to physical social engineering on site. It says it combines human and electronic attack methods to show where training or technical controls fall short.

Its red team work simulates an adversary using tactics, techniques and procedures drawn from real attacks, designed to test how well a client detects and responds. The site also lists AI and language-model testing for risks such as prompt injection, data leakage and weaknesses in retrieval-based systems.

Mobile, wireless and IoT assessments

Mobile testing covers iOS and Android apps, with manual testing alongside dynamic and static analysis of the code. Wireless testing tries to breach a client's network and reports the misconfigurations it finds. IoT testing covers devices used in many industries, including industrial control and SCADA systems, and examines interfaces, firmware, hardware, communication channels and encryption.

Scoping each test around the client

The firm says no two tests are the same. Its consultants meet the client to hear its concerns, agree a plan and scope the work around the client's environment, timetable and customers. Results come as a data-driven action plan that sets out how to fix the flaws it found.

The firm says it has worked in many sectors, including government, and that its consultants include former system administrators, developers, network engineers and cloud specialists. It also states that its consultants have taught and spoken at security conferences.