Your auditor is asking for a pentest. We run it.

With a conversation, not a purchase. A scoping call establishes what you've built, what's genuinely exposed, and what your customer or regulator is asking you to prove. Sometimes the answer is a focused test on one portal; sometimes it's a readiness gap assessment first. You'll get a straight recommendation either way — including if the honest answer is "not yet."

It shouldn't, and preventing that is part of scoping. Testing targets staging or a dedicated environment wherever possible, windows are agreed in advance, and destructive techniques are excluded unless explicitly authorized. Payment and clinical workflows get particular care — no test transactions against live rails, no interference with care delivery. You get an emergency contact and a defined stop condition before testing begins.

Most of it. Hospital and enterprise procurement — and a QSA reviewing PCI DSS 11.4 — typically asks whether you've had independent third-party testing, when it last happened, what methodology was followed, and how findings were remediated and retested. A framework-mapped report plus completed retest evidence answers all four. If the questionnaire extends into governance and policy, a readiness assessment covers that ground.

Scanners find known patterns — vulnerable dependencies, missing headers, common misconfigurations. They can't reason about your business workflow, so they won't find that a user at clinic A can reach clinic B's records by changing an ID, that a transaction limit can be bypassed by reordering a payment flow, or that your assistant can be talked into repeating what a previous customer told it. PCI DSS is explicit that a vulnerability scan is not a penetration test — Requirement 11.4 asks for active exploitation, which needs a person who understands how the system is meant to behave.

A report written for two audiences — an executive summary for leadership and auditors, and technical detail your engineers can work from directly. Each finding carries severity, plain-language business impact, framework mapping, working reproduction steps, and specific remediation guidance. Plus a walkthrough call, and the retest verification afterwards.

Reiver Security is Canadian-owned and based in Ontario. Testing is performed in Canada by one named practitioner — nothing is subcontracted offshore — and engagement data, evidence, and reports are stored in Canada. For PHIPA-covered organizations and Canadian financial institutions, that usually matters: it keeps your assessment evidence inside Canadian jurisdiction rather than adding a cross-border data question to your next audit. Engagements are contracted in Canada.

One named CISSP-certified practitioner with a professional background in web application penetration testing — not a rotating bench and not an offshore subcontractor. You'll know who is testing your system, and that person is on the walkthrough call. For a small team that continuity is usually the point: the tester who found it is the one explaining it. PCI DSS is explicit that the tester does not need to be a QSA or ASV — what it requires is demonstrable competence and organisational independence, both of which are documented in the engagement record.

Small teams are the core of this practice. Large vendors price and staff for enterprise portfolios, which leaves early-stage health-tech and fintech paying enterprise rates for attention they don't get. The Focused tier is deliberately sized for a company that has shipped a product but hasn't hired a security team yet.