A small purple-team practice that prefers depth over headcount.
Tholim was put together by a small group of operators who got tired of two extremes — the offshore "audit" that ships a 200-page report no engineer reads, and the boutique "rockstar" engagement priced like a luxury car. We sit in the middle: a focused practice that goes deep on a small number of clients per quarter, ships findings the engineering team can act on inside the same sprint, and stays involved through remediation.
Three operating decisions that shape every engagement.
Mozilla Observatory, sslyze, RetireJS, ProjectDiscovery's nuclei and subfinder, the Chrome HSTS preload list, AlienVault OTX, Shodan InternetDB, certificate-transparency logs, Wayback Machine. Where the field has converged on a reference implementation, we use it. Where one is missing — JA4S server fingerprinting, Shodan-style favicon hashes, baseline-diff continuous monitoring — we wrote ours and made them open source.
Every finding ships with the exact request, response, or capture that proves it, plus a remediation note scoped to the stack we found in the audit — not a generic OWASP boilerplate paragraph. Where the fix is mechanical we'll open the pull request. Where it requires architectural change we walk through it with whoever owns the codebase.
A pentest report that lands in a forgotten Drive folder is a refunded engagement waiting to happen. We attach a 30-day post-delivery window for clarification and re-tests at no extra cost, and offer continuous attack-surface monitoring as a low-friction follow-on for clients that want a baseline alarm on their public footprint.
A finding is not closed until the re-test runs clean.
Most pentest reports land in a Drive folder, get triaged into Jira, and rot. We close the loop with the engineering team that has to ship the fix — same week, same channel, same sign-off script. The retainer model below is included in every fixed-fee engagement.
Scope letter, RoE, kickoff. Written authorisation timestamped.
Designate a single eng owner. Provide read access to the surface in scope.
scope.md · authorisation.txt
Active testing. Findings filed live into a shared Slack/Linear/GitHub channel as they land — not batched at the end.
Triage in real time. Push back on false positives. Ask for clarification on the spot.
F-NNN_*/ evidence folders
For mechanical fixes — open the PR. For architectural ones — pair with the owner over voice or doc until the approach is agreed.
Review, merge, deploy. We stay available during business hours of the chosen timezone.
PR with retest.sh attached
Re-execute every finding's retest.sh against the patched surface. Within 30 calendar days of delivery — included.
Confirm the fix is live in the environment we're testing.
07_retest.sh exit code 0
Sign-off note: who verified, when, ticket reference. Repository archived with a 12-month retention per editorial policy.
Counter-sign. Optional: continuous monitoring as a low-friction follow-on.
08_signoff.md · monitor cron
Refusing the wrong work is part of the work.
Bigger isn't better when the work doesn't fit. We will say no — early, with a referral where we can — when one of the criteria below applies.
- DECLINED
No written authorisation, no work. If the contact reaching out cannot demonstrate authority over the target, we do not start.
- DECLINED
Adversarial reconnaissance against third parties. Audits to inform a lawsuit, an acquisition without consent, or a public attack-surface dump on a competitor — out of scope.
- DECLINED
Compliance theatre. "We need a report that says we are secure" is not a brief. We can help you actually be secure; we cannot help you appear to be.
- DECLINED
Engagements outside our depth. Embedded firmware, cryptography research, ICS/SCADA, hardware reverse engineering — we will refer you to specialists rather than fake it.
The rulebooks our deliverables map to.
Every report cross-references the relevant control IDs from the standards below, so your security or compliance team can trace each finding to its corresponding obligation without rewriting the deliverable.
Penetration Testing Execution Standard
Web Security Testing Guide
Application Security Verification Standard, L1 to L3
Reconnaissance & Initial Access tactics
AWS / GCP / Azure / Kubernetes
Mapping for executive summaries
DMARC · MTA-STS · TLS-RPT
security.txt · Coordinated disclosure
If your problem fits the brief above, write to us.
Two-working-day reply with a scoping note, rough timeline, fixed-fee estimate. If we are not the right fit, we will say so and refer you to a practice that is.