What we do
We assess web applications, APIs and infrastructure, validate risks and help remediate vulnerabilities.
Assessment scope
For web applications and APIs we review authentication, sessions, access control, input handling, configuration and business logic. Infrastructure assessments cover the external perimeter and, where access is provided, internal services and trust boundaries. Systems, addresses, roles and exclusions are agreed in the scope.
Testing format
Black-box tests start without internal knowledge. Gray-box tests use limited access, such as accounts for different roles. White-box work can include architecture, configuration and source code. The format follows the assessment objective, system maturity and available time, with depth and completion criteria agreed separately.
Scope and rules of engagement
Before testing we agree owner authorisation, in-scope assets, the testing window, permitted activities, load limits, emergency contacts and evidence handling. Destructive activities, social engineering and load tests require separate scope. Critical findings are escalated to the nominated contact.
Automation and manual validation
Automated checks are complemented by manual analysis to validate findings and assess role-dependent and business workflows. OWASP WSTG categories inform the web-testing plan, adapted to the target. Evidence is limited to what is needed, with test and production data handling agreed in advance.
Actionable reporting
Each validated finding identifies the affected asset, prerequisites, evidence, impact, risk and remediation advice. Priority reflects exposure, data sensitivity and environmental constraints. Technical findings are accompanied by an executive summary and a remediation plan discussed with development and infrastructure teams.
Retesting after remediation
After remediation we retest the agreed findings and document resolved and outstanding risks and assessment limitations. A penetration test reflects a system at a point in time within a defined scope. Retesting is useful after significant changes to architecture, access or functionality.
Scope and deliverables
- Web application and API penetration tests
- External and internal infrastructure assessment
- Authentication, access control and business-logic review
- Manual validation of findings
- Impact assessment and risk prioritisation
- Remediation guidance and retesting
Pricing and contract
Pricing follows the assets and roles, testing depth, access format, timeline and retesting scope. The contract records scope, rules of engagement and evidence handling.
Software and service pricingFAQ
Can a production system be tested?
Yes, with owner authorisation, an agreed window, limits and emergency contacts. Higher-risk scenarios may require a test environment. The plan accounts for service continuity.
What is needed for an estimate?
Applications, APIs and addresses, user roles, architecture, the black/gray/white-box format, constraints and target dates. We then define scope, reporting and retest arrangements.