Penetration testing and application security
We test web apps, mobile apps and APIs the way an attacker would, only with your consent and within an agreed scope. You get a list of vulnerabilities with risk ratings and a specific way to fix each one.
When to order a pentest
Before a new system goes live
Fixing a flaw before release is many times cheaper than handling an incident after a data leak.
A client or partner requires a report
Large customers and financial institutions ask for current security test results.
After a major change in the application
A new payment module, sign-in through an external provider or a cloud migration all change the attack surface.
What you get
A report clear enough for management and detailed enough for developers.
Technology
- Burp Suite
- OWASP ZAP
- Nmap
- Kali Linux
Scope and rules of engagement
We list addresses, test accounts, time windows and contacts, and start testing after written consent.
Web application and API tests
Authentication, access control, injection, business logic and configuration according to OWASP.
Mobile application tests
Data storage on the device, communication with the server and the protections of the app itself.
Report with risk ratings
Each vulnerability has a description, evidence, a CVSS score and a fix recommendation.
Review with the team
We go through the results with developers and agree the order of fixes.
Retest
Once fixes are in, we verify that the vulnerabilities are gone and update the report.
How we work together
- 01
Scope and consent
We agree what we test, in which mode and when, and sign a contract with an NDA.
- 02
Testing
We combine automated tools with manual analysis of the application's logic.
- 03
Report
We describe vulnerabilities from the most serious, with steps to reproduce them.
- 04
Retest
We verify the fixes and issue the final report.
What the estimate depends on
- number of applications, user roles and API endpoints
- test mode: no knowledge of the system, with test accounts, or with access to code
- a mobile app for one or two platforms
- test or production environment
- retest and support during fixes
We don't publish a price list, because every project has a different scope. After a short conversation you get a free estimate split into stages.
Request an estimateQuestions about this service
If your question isn't here, write to us.
How is a pentest different from an automated scan?
A scanner finds known, typical flaws. A pentester also checks the application's logic, for example whether a user can see someone else's order by changing a number in the URL. A tool will not detect such flaws.
Can testing disrupt the system?
It is safest to test on a staging environment identical to production. If we test production, we agree time windows and exclude actions that could affect availability.
Which methodology do you follow?
We rely on the OWASP Web Security Testing Guide, the OWASP Top 10 and the ASVS standard, and on OWASP MASVS for mobile apps.
How often should tests be repeated?
At least once a year and after every major change to architecture, sign-in or payments.
Tell us about your project
Tell us what you want to build or verify. We'll come back with questions, a proposed approach and an estimate.
Free estimate · NDA on request
What happens next
- 1A short call
- 2Estimate with a schedule
- 3Work begins