Compliance passed. The app was still vulnerable.

How we got here

In 2019, Alex Koval was running a penetration test for a client that had passed their SOC 2 audit three months earlier. He found a critical SQL injection vulnerability in their production API — the same API their auditor had reviewed and cleared. The compliance checkbox said secure. The application was not.

Alex teamed up with Dana Ortiz, who had spent years on the audit side and knew exactly how controls got checked without real validation. Together they built SecTests: a platform that runs actual security tests continuously, mapped directly to compliance frameworks so the audit evidence reflects reality.

We launched in 2020 out of Portland, Oregon. Today the team is around 20 people — security engineers, platform developers, and a small team focused on compliance framework coverage. We are profitable, independent, and not interested in building features nobody asked for.

Who builds SecTests

Security engineers, platform developers, and compliance specialists.