'They make sure that network security is not a complete disaster,' he said.īut automated scans don't work as well with customized Web applications and e-commerce environments, Desautels contended.

He noted that after being asked to do security assessments by 10 companies with Hacker Safe logos on their Web sites, SecureState was able to break into nine of the sites and easily access financial and customer data.Īdriel Desautels, chief technology officer at Netragard, a Mendham, New Jersey-based company that offers manual vulnerability testing services, said automated scans can be useful in ensuring that a Web site is protected against known security flaws. 'Web applications are very dynamic and ever-changing,' whereas vulnerability scans rely on static information to identify security issues, Kennedy said. They focus more on spotting network vulnerabilities than on detecting harder-to-find Web application flaws, such as SQL injection and cross-site scripting vulnerabilities, he said. ScanAlert's automated probes offer a 'very basic form of vulnerability identification,' Kennedy claimed. SecureState is a consulting firm in Cleveland that offers security risk assessment services and does manual penetration testing of systems and networks for its clients. 'Hacker Safe seals are completely ludicrous,' said David Kennedy, who heads SecureState LLC's profiling and e-discovery practice.

Napa software cracker