Home Services Projects About Contact
Adversary simulation for enterprise risk owners

Know how you get breached. Before they do.

Circlete runs senior-led attack simulations against your networks, applications, and APIs — then translates every exploit path into business risk, prioritised remediation, and a plan your board can fund.

Book a Scoping Call → See the Six Services →
6
Core Services
100%
Manual Testing
72hr
Report SLA
Six services · One risk picture

Test like an adversary.
Report like a strategist.

Each service answers a question your leadership is already asking: where can we be broken, how far could an attacker get, and what should we fix first? Combine them for a complete view of exposure.

01 / NETWORK VAPT

Network VAPT

Simulate an insider or a post-phish intruder moving through your internal estate. We map Active Directory, abuse misconfigurations, and escalate privilege the way a real attacker would — to show how far one foothold really goes.

  • Active Directory attacks & Kerberoasting
  • Lateral movement & pivoting
  • Network protocol exploitation
  • Credential harvesting simulation
  • Segmentation validation
  • CVSS-scored findings report
Risk reducedContain the blast radius of a single compromised endpoint or account.
02 / WEB APP VAPT

Web Application VAPT

Manual-first testing that goes past scanner output — chaining business-logic flaws, authentication bypasses, and injection into exploit paths that matter to revenue and customer data.

  • OWASP Top 10 & WSTG
  • Authentication & session analysis
  • SQLi, XSS, SSRF, XXE
  • Business-logic exploitation
Risk reducedProtect customer data and the applications your revenue runs on.
03 / API VAPT

API VAPT

Modern products live and die by their APIs. We test REST, GraphQL, and SOAP against the OWASP API Top 10 — from broken object-level authorisation to mass assignment.

  • BOLA / IDOR at scale
  • Token analysis & replay
  • GraphQL introspection abuse
  • Postman / OpenAPI integration
Risk reducedClose the quiet data-exposure paths behind your mobile and partner integrations.
04 / CONFIGURATION ASSESSMENT

Firewall & Network Devices Configuration Assessment

Your perimeter is only as strong as its rules. We review firewall, router, and switch configurations against hardening baselines to find over-permissive rules, weak management access, and drift that scanners never see.

  • Rule-base review & shadowed rules
  • Management-plane hardening
  • Firmware & known-vulnerability checks
  • Segmentation & zone design review
Risk reducedRemove the silent misconfigurations that turn a small gap into an open door.
05 / DARK WEB LOOKUP

Dark Web Exposure Lookup

Find out what attackers already know about you. We identify leaked credentials and exposed corporate data circulating outside your perimeter, so you can rotate and respond before they are used against you.

  • Leaked staff credentials
  • Exposed corporate data
  • Prioritised takedown & reset guidance
Risk reducedCut off the easiest way in: credentials already in an attacker's hands.
06 / 30-DAY IMPROVEMENT PLAN

30-Day Improvement Plan

Findings do not reduce risk until they are fixed. We turn results into a sequenced, owner-assigned plan your team can act on immediately — ordered by business impact, not by severity score alone.

Week 1
Close critical exposure
Weeks 2–3
Harden high-risk systems
Week 4
Verify and report upward
Risk reducedMove from a report on a shelf to measurable risk reduction in a month.

Not sure where to start? Our Cybersecurity Health Check combines an external vulnerability scan, firewall review, Microsoft 365 review, dark web exposure check, and a prioritised risk report with the 30-Day Improvement Plan.

Request a Health Check →
How we work

A disciplined engagement, from scope to board-ready report.

No surprises. Rules of engagement are agreed up front, testing is controlled, and every deliverable is built for both the engineers who fix and the executives who fund.

01
Scoping

Define boundaries, rules of engagement, and success criteria with your team, anchored to the business systems that matter most.

02
Recon

OSINT, footprinting, and passive and active enumeration of the attack surface an adversary would see.

03
Exploitation

Manual exploitation of findings — chaining vulnerabilities to demonstrate true impact, not theoretical severity.

04
Post-Exploitation

Lateral movement, persistence, and privilege escalation within agreed scope, showing how far an intruder could go.

05
Reporting

Evidence-backed findings with CVSS scores, an executive summary, and a prioritised remediation roadmap.

Beyond security

Secure by design,
built to run.

Alongside our offensive security practice, we build custom software for clients who need more than a report — they need a working system, tested by people who break systems for a living.

Custom dashboard · United Kingdom

Sales & Commission Dashboard

Client: Knottinger Limited — Leeds, U.K.

Knottinger Limited is a Leeds, UK-based brand celebrating colour, craftsmanship and creative expression, and the concept store behind more than 40 independent makers. We designed and built a sales and finance management dashboard that lets Knottinger import sales and commission data directly from their POS systems, then view consolidated statistics on product performance and creator payouts in one place.

Because the store represents dozens of independent makers rather than a single seller, the platform was architected with multi-tenancy at its core — Knottinger can grant each individual creator their own login to view exactly their own sales and commission figures, without visibility into other makers' data. The system follows a multi-tier architecture, with an isolated backend, a dedicated business logic tier, and a separate internet-facing consumer interface, keeping sensitive data and processing away from the public-facing layer.

POS Data Import Sales Analytics Commission Tracking Multi-Tenant Access Mobile & Web Pentest
What we delivered
  • Automated ingestion of sales & commission data from POS exports
  • Consolidated product-level sales statistics and reporting
  • Per-creator commission calculation and breakdown
  • Multi-tenant architecture with isolated creator accounts
  • Individual creator logins to self-serve their own sales data
  • Mobile-responsive dashboard for on-the-go access
  • Penetration test of the mobile app and consumer-facing website, with a findings report and remediation advice
Who we are

Practitioners who have
stood on both sides.

Security is not a one-time audit. It is a continuous loop — assess, defend, reassess — and Circlete partners with you across all of it.

Circlete is a Managed Security Services Provider focused exclusively on offensive security — penetration testing that goes beyond checkbox compliance and into real adversarial simulation.

Every engagement is led by a senior consultant. No junior-only teams. No automated reports dressed up as manual testing. When we find a vulnerability, we demonstrate its real-world impact — chaining findings into attack paths that tell your board exactly what an attacker would do.

We work with SMEs, fintechs, healthcare providers, and enterprise clients across Sri Lanka and beyond — organisations that cannot afford a breach and need assurance they can act on. Our deliverables serve two audiences: the technical team who will fix the issues, and the leadership who must understand and own the risk.

SECURE
We find vulnerabilities before your adversaries do. Every engagement is scoped for maximum realistic impact — not surface-level scanner output.
DEFEND
Our reports are built for action. Prioritised remediation, clear severity ratings, and re-testing included. We don't disappear after delivery.
TRUST
Confidentiality is non-negotiable. Every engagement operates under a signed NDA, strict rules of engagement, and full data-handling accountability.
Get in touch

See what an attacker
would find.

Start with a scoping call. No obligation, no boilerplate pitch — a direct conversation about your exposure, your risk appetite, and the fastest route to reducing it.

✓   Message received. We will respond within 24 hours.
✕   Something went wrong. Please email us directly at contact@circlete.com
Location
Colombo, Sri Lanka
Engagements conducted island-wide and remotely
Email
contact@circlete.com
For general enquiries and new engagements
Response Time
Within 24 Hours
Mon – Fri, 08:00 – 18:00 (IST)
Report Delivery SLA
72 Hours Post-Assessment
Draft findings shared same-day for critical severity items
// All engagements covered by NDA.
// Zero vulnerability data retained post-delivery.
// Free re-test included for all critical findings.