Web applications
Authentication, permissions, sessions, input handling, and the business logic behind important actions.
PENETRATION TESTING
Know what
needs fixing.
Understand how weaknesses connect, what they put at risk, and where your team should focus next.
Compare engagements ↓AN ASSESSMENT, IN FOCUS
01 / Entry pointsAPPLICATION · API
02 / Trust boundariesIDENTITY · ACCESS
03 / Business impactDATA · OPERATIONS
An illustration of our approach, not a live scan.
WHAT WE CAN ASSESS
Start with what matters.
APIs & integrations
Access to objects and functions, exposed information, and the assumptions made between connected services.
Networks & infrastructure
External exposure, internal segmentation, service configuration, and potential paths between systems.
AI applications & LLM agents
Prompt injection, data exposure, and tool permissions. We check what an agent can retrieve or do when it encounters untrusted input.
CHOOSE YOUR CADENCE
A focused check.
Or a regular conversation.
One-off assessment
For a defined application, release, or security concern.
- One agreed assessment window
- Scope based on your application and user roles
- Evidence and a prioritized report
- Findings walkthrough with your team
Twice-yearly testing
For teams that want a regular point to review what has changed.
- Two planned assessment windows per year
- Scope reviewed before each assessment
- Compare findings across both reviews
- Agree remediation and retest arrangements
Custom engagement
For a wider environment or a particular technical challenge.
- Applications, APIs, or infrastructure
- Phased scope and delivery milestones
- Coordination with your technical team
- Reporting and support agreed to fit the work
Pricing depends on scope, user roles, environment complexity, and assessment depth. Retesting, timing, and deliverables are confirmed in the proposal. The recommendation describes a useful cadence, not a sales ranking.
FROM FIRST CALL TO FOLLOW-UP
A clear path through the work.
01 / Agree
Define assets, permissions, access, safe testing windows, and the people to contact.
02 / Investigate
Combine focused tooling with manual checks. Validate findings and keep you informed.
03 / Explain
Provide evidence, business context, reproduction steps, and practical remediation guidance.
04 / Recheck
Walk through the report and arrange checks of agreed fixes within the retest scope.
A REPORT YOUR TEAM CAN USE
Evidence first.
Clear next steps.
A finding should explain the affected system, the conditions needed to reproduce it, and what a fix needs to prevent. We distinguish confirmed issues from areas that need more investigation.
Tools may include Burp Suite, Nmap, and Wireshark, chosen for the agreed scope. Tool output is a starting point for investigation.
ILLUSTRATIVE FINDING
A permission check is missing.
- Observation
- A test user can access another test account’s record.
- Why it matters
- Private information may cross an account boundary.
- Next step
- Enforce ownership checks on the server, then test allowed and denied access.
Before we begin.
What do you need for a quote?
An outline of the assets, application size, user roles, target dates, and any constraints. Share the overview in the form; we can agree a secure way to exchange technical details afterwards.
Can you test a production system?
We discuss the risks and suitable environment before agreeing scope. Written authorization, testing boundaries, stop conditions, and an emergency contact are required.
Does a test guarantee security?
No. An assessment examines an agreed scope during a defined period. Reports describe coverage and limitations so your team can plan further work.