Crosslake Insight Applications provide deeper, comprehensive examinations of a client’s systems to identify investment risks and opportunities. The following describes each Insight Application offered by Crosslake Technologies as a component of certain services. Clients should refer to the “Services in Scope” section of each Statement of Work (SOW) to determine the availability of any Insight Applications listed below.
Attack Surface Penetration Test
The Attack Surface Penetration Test is a focused security assessment that simulates real-world attacks on an organization’s internet-facing systems to identify and remediate exploitable weaknesses before adversaries can abuse them. This service is applicable to most reps and warranties insurance considerations.
All testing is performed in a safe manner with throttling enabled for automated testing and safety checks enabled for all requests to servers or infrastructure. No denial-of-service attempts will ever be performed as part of testing nor will attempts to exploit an identified vulnerability that may result in performance or availability degradation.
Scope
The default scope for the test is up to five (5) domains and fifty (50) IP addresses, which is a reasonable upper limit for most organizations. If more domains or IP addresses are required, additional fees may apply.
The client may engage Crosslake to perform a one-time repeated assessment within three months at no cost by providing written approval.
Process
Crosslake will coordinate with client leadership and the environment owner to complete the delivery of this project.
The Attack Surface Penetration Test will consist of the following steps, responsibilities, and dependencies:
- Crosslake will perform the penetration test using internal resources.
- The penetration test will be performed remotely.
- The test cannot begin until the client or environment owner has provided the in-scope domains, IP addresses, or hostnames for the test.
- Once received, Crosslake will begin testing the environment using a combination of manual testing and automation to provide full coverage and confidence that all areas of the attack surface have been tested. Where appropriate, attempts to exploit vulnerabilities identified in the environment will be made to validate actual exposure. Attempts to exploit potentially unsafe vulnerabilities or denial of service testing will never be performed.
- Crosslake will prioritize all findings for the testing based on criticality to the business and inherent security risk.
- Crosslake will deliver a report detailing:
- Overall risk grade (A-F)
- Executive summary
- Testing methodology
- Findings inventory and criticality
- Findings description, evidence, suggested remediation, and background information
- Crosslake will deliver an engagement letter with overall grade and findings summary.
Data Theft Risk Assessment
The Data Theft Risk Assessment searches hidden networks, illicit marketplaces, and public data sources for an organization’s leaked data, credentials, and mentions, delivering early warnings and actionable findings to contain exposure and reduce risk.
Scope
This service leverages a list of key words representing the company in order to search for its data effectively. The default scope is limited to 50 key words.
The client may engage Crosslake to perform a one-time repeated assessment within six months for an additional discounted fee by providing written approval.
Process
The Data Theft Risk assessment consists of the following steps, responsibilities, and dependencies:
- Crosslake will coordinate with client leadership, the company (if different from the client), and Crosslake service partners to complete the delivery of this project.
- The company will provide a form containing key words corresponding to the company such as domain names, executive names, subsidiary names, and product code names, as well as acknowledgement that the search is taking place.
- Crosslake will leverage a service provided by SpyCloud to detect credential leaks for the company’s domain on the dark web.
- In addition, Crosslake will leverage CybelAngel, a partner that determines whether and how confidential information has leaked to the clear, deep, and dark webs over the last 12 months. This information includes data such as documents, intellectual property, and compromised user accounts.
- Crosslake will analyze the results of the partners’ output and provide risk assessments and remediation recommendations, as applicable.
Open-Source Assessment
The Open-Source Assessment is a software scan and review of third-party and open-source components to detect known vulnerabilities, outdated or insecure versions, and license risks. This assessment is applicable to most reps and warranties insurance considerations.
No code is shared with Crosslake or a third-party in order to execute this scan.
Scope
The default scope of the assessment is up to 10,000 open-source software (OSS) libraries, which is a reasonable upper limit for most software products. If the library limit is exceeded, additional fees may apply.
The client may engage Crosslake to perform a one-time repeated assessment within six months for an additional discounted fee by providing written approval.
Process
The Open-Source Assessment consists of the following steps, responsibilities, and dependencies:
- Crosslake will coordinate with client leadership, the code owner (if different from the client), and Crosslake service partners to complete the delivery of this assessment.
- This service will leverage CAST Highlight, a platform that analyzes open-source libraries.
- Crosslake will provide instructions to the code owner to execute the scan.
- The code owner will execute the CAST Highlight Agent using the provided instructions which analyzes a folder containing a copy of relevant source files and dependencies. Note that source code does not leave the machine, only the results of the scan.
- The code owner will provide a CAST Highlight survey for each scan (not to exceed four scans) and the results of the scans to Crosslake.
- Crosslake will provide the results to Crosslake’s partner.
- Crosslake’s partner will receive the output of the scan and analyze the results.
- Crosslake will analyze the results of the partner’s raw output and provide findings and recommendations based on:
- Inappropriate licenses associated with open-source components
- Known security vulnerabilities
- Outdated open-source libraries
Static Application Security Test
The Static Application Security Test is a software scan which determines the level of security weaknesses within code and defensive coding practices within the development organization.
No code is shared with Crosslake or a third-party in order to execute this scan.
Scope
The default scope of assessment is one business application.
The client may engage Crosslake to perform a one-time repeated assessment within six months for an additional discounted fee by providing written approval.
Process
The Static Application Security Test assessment consists of the following steps, responsibilities, and dependencies:
- Crosslake will coordinate with client leadership, the code owner (if different from the client), and Crosslake service partners to complete the delivery of this assessment.
- This service will leverage a set of tools that analyzes codebases for known security weakness patterns.
- Crosslake will provide instructions to the code owner to execute the scans.
- The code owner will execute the scan tools which analyze a folder containing a copy of relevant source files and dependencies.
- The code owner will send the output files to Crosslake. Note that small, valueless snippets of source code may be included to provide context for findings. The source code as a whole does not leave the company’s machine.
- Crosslake will analyze the results and provide findings and recommendations based on:
- Identify security weaknesses in the code based on known patterns.
- Map weaknesses to the MITRE Common Weakness Enumeration (CWE) model.
- Compile statistics about the CWEs detected.
Web Application / API Penetration Test
The Web Application or API Penetration Test is an authorized, simulated cyberattack against an application to uncover exploitable flaws in authentication, input handling, session management, and business logic so they can be remediated before real attackers exploit them. This service is applicable to most reps and warranties insurance considerations.
All testing is performed in a safe manner, with throttling enabled for automated testing and safety checks enabled for all requests to servers or infrastructure. No denial-of-service attempts will ever be performed as part of testing nor will attempts to exploit an identified vulnerability that may result in performance or availability degradation.
Scope
The default scope of the test is a single web application or API. If more than one (1) web application or API is to be tested, additional fees will apply.
The client may engage Crosslake to perform a one-time repeated assessment within three months at no cost by providing written approval.
Activities
The Web Application / API Penetration Test will consist of the following steps, responsibilities, and dependencies:
- Crosslake will coordinate with client leadership and the code or owner to complete the delivery of this project.
- Crosslake will perform the penetration test using internal resources.
- The penetration test will be performed remotely.
- Once Crosslake receives the web application or API URL and user credentials (as applicable), Crosslake will begin testing the environment using a combination of manual testing and automation to provide full coverage and confidence that all areas of the web application or API have been fully tested for the OWASP Top 10 security risks. Where appropriate, attempts to exploit vulnerabilities identified in the environment will be made to validate actual exposure. Attempts to exploit potentially unsafe vulnerabilities or denial of service testing will never be performed.
- Crosslake will prioritize all findings for the testing based on criticality to the business and inherent security risk.
- Crosslake will deliver a report detailing:
- Overall risk grade (A-F)
- Executive summary
- Testing methodology
- Findings inventory and criticality
- Findings description, evidence, suggested remediation, and background information
- Crosslake will deliver an engagement letter with overall grade and findings summary.
Public Cloud Security Assessment
The Public Cloud Security Assessment is a structured review of a cloud environment’s configurations, permissions, and deployed services to uncover misconfigurations, vulnerabilities, and compliance gaps, ensuring cloud resources are secure and aligned with best practices.
Crosslake uses a combination of automated scanning and expert review to provide coverage and confidence that relevant areas of the cloud environment are assessed against industry-recognized best practices. Assessments are performed in a safe manner with read-only access to environments required to be in place. No denial-of-service attempts will ever be performed as part of the assessment nor will attempts to create content, rules, policies, or otherwise modify the client environment in any way. Additionally, client data does not leave the environment for this service.
Scope
The default scope of the assessment is limited to eight accounts within the public cloud environments. Cloud providers must be Google Cloud Platform (GCP), Amazon Web Services (AWS), or Microsoft Azure.
The areas evaluated as part of the assessment include:
- Threat detection
- Encryption
- Logging
- Forensic readiness
- Secrets management
- Internet exposures
- Identity and access management
The client may request Crosslake to perform a one-time re-test of the environment(s) in scope within two months of the original report delivery at no additional charge. Upon completion, an updated report will be delivered to the client.
Process
The Public Cloud Security Assessment will consist of the following steps, responsibilities, and dependencies:
- Crosslake will coordinate with client leadership and the code or environment owner to complete the delivery of this project.
- Crosslake will perform the assessment using internal resources.
- The assessment will be performed remotely.
- Once Crosslake receives the account information and necessary access, Crosslake will begin assessing the environment using a combination of automation and manual verification to provide full coverage and confidence that all areas of the of accounts have been fully assessed.
- Crosslake will prioritize all findings for the testing based on criticality to the business and inherent security risk.
- Public Cloud Security Assessment report(s) to include:
- Overall grade (A-F)
- Executive summary
- Assessment methodology
- Recommendations summary
- Detailed findings inventory with criticality and recommended remediation
Cloud Spend and Utilization Assessment
The Cloud Spend and Utilization Assessment is an evaluation of cloud usage and billing data to identify inefficiencies and opportunities to eliminate waste and optimize costs.
Scope
The default scope of the assessment is limited to eight accounts within the public cloud environments. Cloud providers must be Google Cloud Platform (GCP), Amazon Web Services (AWS), or Microsoft Azure.
Process
The Cloud Spend and Utilization assessment consists of the following steps, responsibilities, and dependencies:
- Crosslake will coordinate with client leadership, the target company administrator(s) and Crosslake service partners to complete the delivery of this project.
- This service will leverage Mavvrik, a platform that manages cloud costs.
- Crosslake will provide instructions to the company to connect the analysis tool to the cloud subscriptions to be analyzed.
- The company will execute the instructions.
- Crosslake will analyze the cloud subscription leveraging the connected tool.
- After initial analysis, Crosslake will engage the company to attain appropriate context for resources identified for potential savings.
- After full analysis, Crosslake will provide a report which summarizes risk assessments based on:
- Identified orphaned and under-utilized resources
- Potential savings from leveraging savings plans and configurations
Productivity Suite Security Assessment
The Productivity Suite Security Assessment is a review of an organization’s collaboration tools (Microsoft 365 or Google Workspace) to detect misconfigurations, insecure permissions, and policy gaps, helping strengthen security controls and reduce risks of data exposure.
Crosslake uses a combination of automated scanning and expert review to provide coverage and confidence that relevant areas of your environment are assessed against industry-recognized best practices. Assessments are performed in a safe manner with read-only access to environments required to be in place. No denial-of-service attempts will ever be performed as part of the assessment nor will attempts to create content, rules, policies, or otherwise modify the client environment in any way. Additionally, client data does not leave the environment for this service.
Scope
The default scope of the assessment is one tenant for either Microsoft 365 or Google Workspace.
The areas evaluated as part of the assessment include:
- Phishing prevention
- Email hardening
- Logging
- Forensic readiness
- Data loss prevention
- Identity and access management
- Email rules best practices
The client may request Crosslake to perform a one-time re-test of the tenant within two months of the original report delivery at no additional charge. Upon completion, an updated report will be delivered to the client.
Process
The Productivity Suite Security Assessment will consist of the following steps, responsibilities, and dependencies:
- Crosslake will coordinate with client leadership and the code or environment owner to complete the delivery of this project.
- Crosslake will perform the assessment using internal resources.
- The assessment will be performed remotely.
- Once Crosslake receives the account information and necessary access, Crosslake will begin assessing the environment using a combination of automation and manual verification to provide full coverage and confidence that all areas of the of accounts have been fully assessed.
- Crosslake will prioritize all findings for the testing based on criticality to the business and inherent security risk.
- Productivity Suite Security Assessment report(s) to include:
- Overall grade (A-F)
- Executive summary
- Assessment methodology
- Recommendations summary
- Detailed findings inventory with criticality and recommended remediation
Code Quality Assessment
The Code Quality Assessment is a software scan and review of poor coding patterns, inefficiencies, and maintainability issues, assessing reliability, performance, and long-term sustainability of the software.
No code is shared with Crosslake or a third-party in order to execute this scan.
Scope
The default scope of the Code Quality Assessment is up to four applications as defined as a full set of services that provides business value.
The client may engage Crosslake to perform a one-time repeated assessment within six months for an additional discounted fee by providing written approval.
Process
The Code Quality Assessment consists of the following steps, responsibilities, and dependencies:
- Crosslake will coordinate with client leadership, the code owner (if different from the client) and Crosslake service partners to complete the delivery of this project.
- This service will leverage CAST Highlight, a platform that analyzes proprietary code for poor coding patterns.
- Crosslake will provide instructions to the code owner to execute the scan.
- The code owner will execute the CAST Highlight Agent using the provided instructions which analyzes a folder containing a copy of relevant source files and dependencies. Note that source code does not leave the machine, only the results of the scan.
- The code owner will provide a CAST Highlight survey for each scan (not to exceed four scans) and the results of the scans to Crosslake.
- Crosslake will provide the results to Crosslake’s partner.
- Crosslake’s partner will receive the output of the scan and analyze the results for poor coding patterns.
- Crosslake will analyze the results of the partner’s raw output and provide risk assessments based on:
- Level of potential coding errors
- Ability to maintain and extend code
- Detection of outdated programming languages
Effective date: October 2025
