Proof & Trust

Built for serious business decisions

Our security background supports the software and systems we build. Explore the founder's credentials, representative security engagements and sample deliverables behind that expertise.

Web portal launch review

Scenario: A business is preparing to launch a customer portal, payment flow, or authenticated web application.

Work: CyGhost reviews authentication, authorization, input handling, exposed data, API behavior, and business logic abuse cases.

Output: The team receives validated findings, evidence, risk ratings, and developer-ready remediation guidance.

Microsoft 365 exposure reduction

Scenario: A company relies on Microsoft 365 and wants to reduce account takeover, weak access, and data sharing risks.

Work: CyGhost reviews MFA, Conditional Access, admin roles, guest sharing, mailbox security, and audit readiness.

Output: Leadership gets a clear hardening roadmap with practical configuration improvements.

NIS2 and GDPR readiness roadmap

Scenario: An organization needs to turn compliance pressure into practical security improvements.

Work: CyGhost maps current controls, identifies gaps, and prioritizes technical and organizational measures.

Output: The business receives an implementation plan, evidence checklist, and control improvement roadmap.

Standards & methods

CyGhost aligns work with recognized security frameworks and practical control guidance where relevant to the engagement.

OWASP Web Security Testing Guide
OWASP API Security Top 10
NIST Cybersecurity Framework
CIS Controls principles
Microsoft security baselines
GDPR security measures
NIS2 cybersecurity expectations
Risk-based remediation planning

Authorization first

Security testing starts with agreed scope, written permission, and clear boundaries.

Evidence based

Findings are validated and explained with practical proof, impact, and remediation context.

Confidential by default

Reports, credentials, logs, and security evidence are handled with discretion and care.

Founder-led delivery

Engagements stay close to the person responsible for quality, communication, and outcome.

Client identities, logos, findings, and testimonials are never published without written permission. The examples on this page describe representative work and founder experience without presenting confidential engagements as public case studies.

Licenses & certifications

Credentials held by founder Obaida Qaba. Issuers and credential details are shown directly so visitors can distinguish verified training from company claims.

Cisco Ethical Hacker

Cisco Networking Academy

Issued March 2026

View credential

Google Cybersecurity

Google

Issued February 2025

Credential ID APWUACSF533P

View credential

Certified Ethical Hacker (CEH) Specialization

LearnKartS via Coursera

Issued February 2025

Credential ID 4TVH8IOBNU8R

View credential

Fortinet Certified Associate in Cybersecurity

Fortinet

Issued January 2025 · Expires February 2030

Credential ID 8051830653OQ

Selected founder experience

An anonymized summary of Obaida's professional background. Employer, customer, and system details are intentionally omitted where confidentiality applies.

NIS2 implementation leadership

Professional experience leading NIS2 control work across infrastructure, access management, business continuity, policies, evidence, and audit readiness.

Network and platform security

Hands-on design and operation of VLANs, routing, firewalls, VPNs, Windows and Linux servers, Active Directory, Microsoft 365, and virtualized environments.

Assessment and response readiness

Experience with vulnerability analysis, Fortinet environments, centralized monitoring, backup and recovery, forensics, malware analysis, and incident preparation.

How trust is built during the work

Scope before testing

Every engagement starts with agreed boundaries, target ownership, timing, and permission.

Validate before reporting

Findings are checked for realistic impact so teams can focus on the issues that matter.

Evidence that helps fixes

Reports include context, proof, reproduction notes, and clear remediation direction.

Clear limits

CyGhost avoids fake guarantees and keeps recommendations grounded in real business risk.

Buyer confidence checklist

  • Defined scope and written authorization
  • Executive and technical reporting
  • Risk-based remediation order
  • Confidential handling of evidence
  • Optional retest after fixes
  • Practical support during implementation

Sample deliverables

  • Prioritized findings with impact and affected assets
  • Screenshots, requests, configuration notes, or other relevant evidence
  • Plain-language business summary for decision makers
  • Developer or administrator guidance for remediation