By application · 5 engagements per quarter
Pro bono penetration testing for nonprofits.
TitanDef does pro bono penetration testing and security assessments for nonprofits, and for other users and clients, as community work. About 90% of our clients are nonprofits. Pro bono testing helps small teams find and fix weaknesses before someone else does.
Pro bono community work, counted.
- 300+
- Nonprofits impacted.
- 3,400+
- People impacted.
Five engagements a quarter, by application.
Every engagement is led by senior testers, so capacity is limited. We select up to 5 organizations each quarter.
- 01
Apply
Tell us about your organization, your mission, and the systems you would like tested.
- 02
Quarterly review
We review applications each quarter and select up to 5 organizations.
- 03
Ownership check
We confirm your organization owns or controls every system in scope.
- 04
Notification
Selected organizations hear from us to schedule a scoping call.
Built on recognized testing standards.
OWASP Top 10 and ASVS
Web application and API testing against recognized application security categories.
NIST SP 800-115
Planning, discovery, testing, and reporting follow the NIST technical testing guide.
Penetration Testing Execution Standard
A defined sequence from pre-engagement and reconnaissance through reporting.
CVSS severity scoring
Each finding is scored so your team knows what to fix first.
Four areas, scoped to what you approve.
External perimeter
Internet-facing systems, as an attacker would see them from outside.
Web applications
Websites, donor portals, and forms your organization runs.
Cloud and Microsoft 365 configuration
Settings that control who can reach your email, files, and accounts.
People and phishing readiness
How well your team spots and reports suspicious messages.
Careful, authorized, and pro bono.
Written authorization first
We get written authorization from your organization before every engagement.
Authorized, non-destructive testing
We test only what you have approved, and our testing is non-destructive.
Pro bono, as community work
Penetration testing and security assessments for nonprofits, and for other users and clients, are offered pro bono as part of our community work.
From first call to findings.
- Step 01
Scoping call
We agree on what will be tested and when.
- Step 02
Written authorization
Rules of engagement are signed before any testing starts.
- Step 03
Testing window
Focused 5 to 7 business days. Standard 7 to 10 business days. Extended 2 to 4 weeks.
- Step 04
Findings and debrief
First findings within 72 hours of kickoff, every engagement.
A report your team can act on.
- A plain-language executive summary
- Prioritized findings with CVSS severity scoring
- Reproduction steps and evidence for every finding
- Step-by-step fix guidance
- A retest of fixed items
How we keep testing safe.
Signed rules of engagement
Targets, testing windows, and contacts are agreed in writing before work begins.
Named emergency contacts
Both sides name people who can be reached at any time during the testing window.
Stop on request
Testing pauses immediately if your team asks, or if anything unexpected appears.
No destructive techniques
No denial of service, no data deletion, and no changes to production data.
Scope enforced
Systems outside the approved target list are never tested.
Handled with care
Findings and evidence are shared only with the contacts you name.
Common questions.
- Who qualifies?
Pro bono testing is offered to nonprofits, and to other users and clients, as community work. Organizations apply, and we select up to 5 each quarter.
- How does the quarterly application work?
Submit an application at any time. We review applications each quarter, select up to 5 organizations, and contact selected organizations to schedule scoping.
- What if we are not selected this quarter?
Your application can be considered again in a later quarter. Tell us if anything about your organization or systems changes.
- Does it cost anything?
No. Penetration testing and security assessments are offered pro bono as part of our community work.
- Will testing disrupt our systems?
Our testing is non-destructive and engineered to avoid production disruption. We test only what you have approved in writing.
- What do we need to prepare?
A short scoping call to agree on what will be tested, and written authorization from your organization before testing starts.
Ask about pro bono penetration testing.
Tell us about your organization and what you would like tested, and we will follow up about pro bono testing.