02 Service
Closed-source software taken apart to find the flaws in what actually shipped, for the teams that build and buy them.
01 Overview
Whether the software you release, or the software you are about to depend on, contains flaws that nobody has found yet. Not whether it is configured correctly, but whether the thing itself is sound.
02 Engagements
Vendors and manufacturers tend to start with the first three.
Compiled software, components, protocols
Taking apart what shipped: executables, libraries and the protocols they speak. Useful when there is no source to review, when the source and the binary have diverged, or when the question is what a component actually does rather than what its documentation says.
Finding what nobody has reported
Structured hunting for previously unknown flaws in a target: fuzzing, static and dynamic analysis, and manual review of the code paths that handle untrusted input. This is open-ended work, so it is scoped by time rather than by a checklist.
Establishing real impact
A crash is not a vulnerability until someone shows what it does. We build a working proof of concept (PoC) to establish whether an issue is genuinely exploitable and what it grants, which is what separates a finding a vendor fixes from one they defer. Written for your environment and handed over with the report.
The code you did not write
Verifying that the software bill of materials (SBOM) matches what is actually linked into the build, and assessing the components that carry real risk. Most modern products are mostly other people's (third-party) code, and the manifest is not always an accurate description of it.
Handling reports, and making them
Two directions. If you receive vulnerability reports, we help you triage, reproduce, and respond without the process becoming adversarial. If we find something in someone else's product, we handle disclosure to the vendor under an agreed timeline and coordinate the teams.
03 Process
Closer to research than to testing, so the shape differs from our other services.
We agree the target, the depth, and what constitutes success. Product work differs from a penetration test here: research is open-ended, so it is bought as a block of time against a defined target rather than as a fixed list of checks.
Written authorization from whoever owns the target, and where the target is a third party product.
Static and dynamic analysis, instrumentation, fuzzing where the target suits it, and manual review of anything reachable by untrusted input. Progress is reported as it happens rather than saved for the end, because research does not run to a predictable curve.
Anything found is proven. We establish exploitability and impact rather than reporting a theoretical weakness.
Technical detail sufficient for your engineers to reproduce and fix, plus a summary for whoever decides whether it is released. If a CVE is appropriate, we handle the request.
If the finding is in a third party product, we manage the vendor conversation under an agreed timeline and keep you informed. Nothing is disclosed without your agreement.
04 Deliverable
Everything below ships with the engagement, whether or not the result is a finding.
05 Questions
A penetration test asks whether a system as deployed can be compromised, and works to a defined scope. Product security asks what is wrong with the software itself, usually without source, and is open-ended. Same questions, different methods.
That is a real outcome. Research focus on depth of examination, not a guaranteed finding. The report documents what was examined and how, which is itself evidence.
Yes, and it is a common reason to engage us. We will assess the overall product quality including security features and mechanisms, and if it aligns with your organization requirements.
You do. Findings, proof of concept code, and any tooling written during the engagement are yours, delivered with the report. We publish nothing without your written agreement.
Yes. Setting up a vulnerability disclosure policy, a security.txt, and a triage process is usually cheaper than handling the first unsolicited report badly, and it changes how researchers and bug bounty hunters approach you.
06 Contact
TowerVector will assist you in taking your security strategy to the next level. Please feel free to contact us: