Web applications
Sign-in, sessions, permissions and business logic, the places where real breaches start.
Penetration testing
Find the weaknesses before an attacker does.
We attack your web apps, mobile apps, APIs and networks the way a real attacker would, with your written permission and inside agreed limits. You get a report your developers can act on, and we test again once the fixes are in.
30 minutes to agree what we test, how, and when.
CPX-07
HighCVSS 8.1
Any signed-in user can open other customers' invoices
- Affected
- GET /api/invoices/{id}
- Impact
- Exposes the names, VAT numbers and amounts of every customer.
- Fix
- Check that the invoice belongs to the caller's account before returning it.
- Found
- Fixed
- Retested
What we test
Everything an attacker can reach
Mobile apps
iOS and Android apps, how they store data on the phone and how they talk to your servers.
APIs
The endpoints behind your apps and integrations, tested for access control, input handling and data leaks.
Networks and cloud
Your internet-facing servers and cloud setup, from open ports to misconfigured storage.
A scan lists what might be wrong. A test proves what is.
Automated scanners are a useful start, but they miss the flaws that matter most: a user who can see another user's data, a discount applied twice, an admin page left open. We use the tools, then think like an attacker and confirm every finding by hand, so your team doesn't waste time on false alarms.
How an engagement runs
Four steps, agreed before we start
- 1
Scoping
We agree what is in scope, the test type, the dates and who to call if something breaks. Nothing starts without your written authorisation.
- 2
Testing
We test within the agreed window, and tell you at once if we find something critical instead of waiting for the report.
- 3
Report
Every finding with its severity, evidence, steps to reproduce and a clear fix, plus a summary your management can read.
- 4
Fix and retest
We walk your developers through the fixes, then test again and confirm what is closed.
What you get
A report your developers can act on
- An executive summary: the overall risk and what to fix first, on one page.
- Technical findings rated by severity (CVSS), with evidence and steps to reproduce.
- Fix guidance written for the technology you use, not generic advice.
- A retest of the fixed findings and an updated report.
- When you need it, a view that maps the findings to the NCA Essential Cybersecurity Controls (ECC).
How much we know going in
Black, grey or white box
| What we need from you | Best for | |
|---|---|---|
| Black box | Only the address of the app or network | Seeing what an outsider can do |
| Grey box | Test accounts for each user role | Most web and mobile apps, and the best value |
| White box | Accounts, documentation and source code | Critical systems and the deepest review |
We test hard, and carefully
We only test what you authorise in writing, in the windows you approve. We don't delete data or run denial-of-service attacks, and everything we find stays confidential between us and the people you name.
FAQ
Penetration testing questions
What is the difference between a penetration test and a vulnerability scan?
A scan is automated and lists possible weaknesses, many of them false alarms. A penetration test is done by people who try to exploit those weaknesses, confirm which ones are real, and show what an attacker could actually reach.
Will testing disrupt our live system?
We agree the testing windows and limits with you, avoid anything that could take a system down, and can test a staging copy instead of production. If something unexpected happens, we stop and call your named contact.
How long does a test take?
It depends on the size of the scope. You get a fixed timeline after the scoping call, before you commit to anything.
How often should we test?
At least once a year, and after any major change such as a new app, a large release or a move to the cloud. Periodic penetration testing is also part of the NCA Essential Cybersecurity Controls.
What do you need from us?
A signed authorisation, the scope (addresses, apps and environments), test accounts for grey-box testing, and a contact person during the test window.
How much does it cost?
It is quoted on the scope: how many apps, user roles and endpoints, and the test type. You get a fixed price after the free scoping call.
Know your weak spots before someone else does.
Book a free 30-minute scoping call. We agree what to test, then send you a fixed quote.
Book a free scoping call