Customer Case: Tozetta x Sensing Clues
Sensing Clues, a non-profit organization, wanted to take the next step in cyber security. Tozetta helped with a pentest.
In early 2024, Tozetta successfully carried out a pentest at Sensing Clues. Sensing Clues is a non-profit organization dedicated to nature conservation professionals. They help protect and manage nature reserves through data-driven solutions. We spoke with Hugo Koopmans, Chief Technology Officer at Sensing Clues.
Why did Sensing Clues have a pentest carried out?
Hugo: "We host our own stuff in a Dutch data center run by bit.nl. They're one of our most important sponsors and a fantastic partner. If you host everything yourself, security is part of that too. After a migration of our virtualization software and a number of changes to how we've set up our deployment pipelines, it's always wise to have an external party take a look at your setup.
We've had this done before too, and it feels good to let 'strangers' look in the kitchen who can point out things you could be doing better. Always a bit nerve-wracking, but especially in this day and age, honestly indispensable."
Why did Sensing Clues choose Tozetta?
Hugo: "Our paths crossed at the right moment. We'd already had an external party look at our cyber security before, during a major change — that time through a hackathon run by a large service provider in the cyber security world. That was also a great success and very valuable at the time (sometime around 2016, I think). It was time to work with an external party again."
How did the collaboration with Tozetta go?
Hugo: "Very well, I can say. Even though we responded rather slowly and ultimately needed more time, the actual pentest went very smoothly. Good communication, daily updates were very clear. And I have to say the report was really excellent. Very clear and very usable results. Understandable and reproducible for us. I was pleasantly surprised by that."
I have to say the report was really excellent. Clear, reproducible, and therefore usable. I was pleasantly surprised by that.
Hugo Koopmans, Chief Technology Officer
What would you tell organizations that are still hesitant about carrying out a pentest?
Hugo: "These days, it's really not a question of whether you should do this — it's more a question of how often and after which changes. Besides having experts scrutinize you and expose demonstrable vulnerabilities, you also get good insight into which weaknesses actually lead to which kinds of risks. So you can properly assess what you need to fix ASAP and what risk you find acceptable.
Besides that, it's of course good for your peace of mind when external parties have looked at it and are satisfied, without finding anything too major. Discussing the vulnerabilities with Tozetta's experts is also very valuable. Your expertise and knowledge of the latest hacking tricks is simply an indispensable piece of expertise — I'm always surprised by the resourcefulness of the hacker guild, and of course I can never keep up with that myself. It's nice to be able to lean on people who specialize in this. So I'd say: do it!"