Stingrai ran a hybrid penetration test of a business verification platform's web applications and APIs, with human penetration testers working alongside Snipe, Stingrai's autonomous agent. The engagement supported the client's annual SOC 2 penetration testing requirement.
Elia Ruberti (Principal for Product and Operations of Mesh ID) hired Stingrai Inc. to accomplish the following goals:
Stingrai tested two web applications that share one GraphQL API. Testing began black box and moved to authenticated grey box across the platform's user roles, with human penetration testers working alongside Snipe. Findings were published to the PTaaS platform as they were confirmed, and the engagement closed with a full report, a 12-month retest window and ongoing scanning.
We needed an independent, human-led penetration test of our web applications and APIs to satisfy our annual testing control for SOC 2, and we needed it to be real security work rather than a compliance checkbox. Stingrai delivered both: evidence our auditors can rely on, and a findings list our engineers are actually acting on. The included retest window and ongoing scanning mean the engagement doesn't end when the report lands.
“The responsiveness is what I'd actually highlight. Vulnerabilities were surfaced through their PTaaS platform as they were found rather than held back for the final report, so we could start triaging mid-engagement. And when we came back with a detailed list of changes we wanted in the report, they returned a revised version within 24 hours that addressed every point - including reworking one finding's remediation advice once we'd discussed the real root cause together. That willingness to engage on the substance rather than defend the first draft is rare.”
The technical depth is well beyond what we expected at this price point. The findings weren't scanner output with a logo on top - the team traced issues back to specific code paths, explained why each one existed, and in several cases pointed out that the fix was extending a control we already had rather than building something new. That made remediation planning dramatically faster.
Two things stood out. First, they were explicit about which of our controls held up under testing, not just which ones failed. That honesty made the whole report more credible and gave us something concrete to show stakeholders. Second, their remediation guidance went past "here's the vulnerability" into practical follow-through, including a step that protected our own customers rather than just closing our ticket.
Genuinely hard to find much. The one thing: the coverage and limitations detail - environment tested, roles used, endpoints actually covered - wasn't in the reporting template by default. We asked for it and they added it properly in a revised report within 24 hours. I'd rather see that as standard in the template from the start, but the responsiveness when we raised it was excellent.
