SUBGRAPH

Core
Services

Comprehensive security assessment and testing across every layer of your infrastructure.

Security Code Review

Deep analysis of your source code to identify vulnerabilities before they reach production. We examine code at all levels — from application logic to low-level system implementations.

  • Manual code review by expert security engineers
  • Static analysis and vulnerability scanning
  • Logic flaw identification
  • Secure coding practice recommendations
  • Developer training and remediation guidance

Architecture Review

A comprehensive evaluation of your system's security architecture, threat model, and design patterns. We identify structural weaknesses before they are built in.

  • Security architecture assessment
  • Threat-modeling workshops
  • Trust boundary analysis
  • Defense-in-depth evaluation
  • Design-pattern security review
  • Compliance and regulatory alignment

Application Penetration Testing

Real-world attack simulation against your applications. We think like adversaries to find the vulnerabilities that automated tools miss.

  • Web application security testing
  • API, microservice, and web service testing
  • Mobile application testing (iOS/Android)
  • Desktop application testing
  • Authentication and authorization testing
  • Business logic vulnerability discovery

Network Penetration Testing

External and internal network security assessment to identify vulnerabilities in your network infrastructure and services.

  • External perimeter testing
  • Internal network assessment
  • Wireless security testing
  • Network device configuration review
  • Segmentation and isolation testing
  • Social engineering assessments

Areas of
Expertise

Specialized knowledge across critical security domains.

Web Application
Testing

Modern web frameworks, SPAs, APIs, and complex client-server architectures.

Low-Level
Code Review

C/C++, memory safety, kernel code, embedded systems, and systems programming.

Cryptographic
Review

Protocol design, implementation review, key management, and cryptographic primitives.

Reverse
Engineering

Binary analysis, malware analysis, protocol reverse engineering, obfuscation defeating.

AI & Agentic
Systems

Machine learning security, prompt injection, model poisoning, adversarial AI.

Privacy
Technologies

Anonymous communication, metadata protection, privacy-enhancing technologies.

Experience &
Credentials

OTF Security Lab

Subgraph is an approved supplier of penetration testing and security audit services for the Open Technology Fund Security Lab. For many years we have been trusted to assess the security of critical tools used by journalists, activists, and human rights defenders worldwide.

Learn more about OTF Security Lab →

10+ Years Testing
Worldwide
∞ Combined
Decades
100+ Organizations
Secured

Public
Security Audits

Selected security reviews available for public review.

Tella

Security assessment of Tella, a mobile documentation app for human rights defenders in challenging environments. Comprehensive review of the mobile application's security architecture and implementation.

View Report (PDF) →

NetAidKit

Security audit of NetAidKit, a portable network security tool. Analysis covered the system architecture, network isolation mechanisms, and security configuration.

View Report (PDF) →

FileZilla

Security assessment of FileZilla, a widely-used FTP client. Comprehensive penetration testing and code review of the file transfer application and its security mechanisms.

View Report (PDF) →

Who We Serve

Organizations that require rigorous security assessment.

Privacy & Human Rights

NGOs, activist organizations, and developers of privacy-enhancing technologies. Tools that protect vulnerable populations demand the highest level of security assurance.

Financial Technology

Fintech platforms, cryptocurrency projects, and payment systems. We understand the unique threat models facing financial infrastructure.

Enterprise Software

SaaS platforms, enterprise applications, and critical business systems. Comprehensive security assessment for production systems.

Open Source Projects

Security-critical open source software, infrastructure tools, and developer platforms. We understand the challenges of public codebases.

Ready to Get Started?

Contact us to discuss your security testing needs.

Get in Touch