Illustration: a scan film, in point clouds, of the places a logistics business runs: a container port from the air, an automated warehouse aisle, a parcel sorting hub, a control tower, a truck yard at night, a rail freight terminal at dawn and the Cantic mark. The labels show synthetic readings and addresses.
We break into your warehouses and fleet before a criminal does.
From your customer portal to the servers that run your warehouses. With Fortify, we write the fix within 24 hours.
Logistics and transport
One way in can stop your deliveries.
Every line to the internet is a door.
Eclipse, our own model trained to attack, keeps going until it can prove full control.
In plain words: an attacker that works for your company.
How far Eclipse goes
- Website
- Apps
- Logins
- Cloud
- Servers
- Internal network
- Machines
What your business runs on
We know what a logistics firm runs on. So do criminals.
Outside firms
- Your IT provider
- Warehouse software supplier
- Conveyor and sorter maintainer
- Fleet telematics provider
- Subcontracted carriers
Remote access
- VPN
- Remote desktop
- Remote support
- Carrier portal
- EDI links
- Telematics cloud
-
Warehouse
- Warehouse management
- Handheld scanners
- Remote access for suppliers
-
Sorting hub
- Parcel sorters
- Scan tunnels
-
Fleet
- Fleet telematics
- Driver app
- Tachograph downloads
-
Control tower
- Transport management (TMS)
- Customer tracking portal
- Freight exchanges
-
Port terminal
- Terminal operating system
- Gate cameras
-
Office
- ERP and invoicing
- Customs declarations
-
Europe
CEVA Logistics, the logistics group
An intrusion disrupted eight warehouses, it said; several customers said shoppers’ contact details were taken.
Sources TechCrunch The Record Logistics Manager
-
United States and Canada
United Natural Foods (UNFI), a food distributor
It estimated a hit of about $350 million to $400 million to fiscal 2025 net sales, before insurance.
-
United Kingdom
Peter Green Chilled, a chilled-food logistics firm
After ransomware, no new orders were processed for a day; its lorries kept running.
Sources The Record Grocery Gazette
Compared
This is not a yearly pentest.
| A normal pentest | Cantic |
|---|---|
| Once a year | Day and night, and on every change |
| A PDF weeks later | Proof as it happens, with a replay |
| Stops at the website | From the website to the server and the machine |
| You work out the fix | We write the fix within 24 hours |
| You hope it holds | We attack again to check it holds |
Under your control
Inside the rules you sign.
Guardrails and data privacy for logistics firms and their customers’ shipments.
Nothing runs until you sign
An authorisation and rules of engagement, signed by someone entitled to authorise the test.
Inside the limits you set
Your scope, hours and limits. It stops once it can prove control.
Stop it within 60 seconds
Rate-limited and time-boxed, so your systems do not slow down.
Every action on the record
Hashed and timestamped in a ledger you can inspect, and followed live.
A person on every critical finding
A named lead on our team.
No outside AI company sees your data
Eclipse is our own model, on our own servers.
Destroyed when the work is done
Deleted in several steps on our side; we do not keep it. First test reports: 14 days unless you subscribe.
Your IT provider gets the fix
Findings and fixes go to your own team or your IT provider.
Regulation
The rules logistics and transport answer to.
- NIS2 covers air, rail and water transport, ports, and postal and courier services, but not hauliers as such (Annexes I and II). 1
- Companies in scope must manage supply chain security and warn of a significant incident within 24 hours (Articles 21 and 23). 1
- Authorised Economic Operator status with customs requires security measures protecting your computer system from unauthorised intrusion (Regulation 2015/2447, Article 25). 2
Questions
What buyers ask us
- Our software suppliers and IT company already connect from outside. Why you?
- Your IT company runs your systems and we attack them: two different jobs.
- What if our systems go down anyway?
- Zero risk does not exist; with Fortify we write a continuity plan, with the switchover rehearsed.
- Does it help with NIS2?
- Yes: every step is recorded, from the signed scope to the retest, but it does not certify compliance.
How it starts
Your results in one day.
You sign the rules
An authorisation and rules of engagement, signed before anything runs.
Eclipse tests what is in scope
From the outside, the way an attacker would. There is nothing to install.
We put the findings on the table
In plain words, with what to do. Every finding comes with proof.
Sources
- EU Official Journal (publications.europa.eu), Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), . Read on .
- EU Official Journal (publications.europa.eu), Commission Implementing Regulation (EU) 2015/2447 of 24 November 2015 laying down detailed rules for implementing certain provisions of Regulation (EU) No 952/2013 of the European Parliament and of the Council laying down the Union Customs Code, . Read on .