Service 01
Penetration testing & application security
We test your systems the way an attacker would, so you find the weaknesses before anyone else does. Every finding comes with guidance your engineers can act on.
What it covers
01
Penetration testing & ethical hacking
Manual testing of web applications, APIs, internal and external networks and cloud accounts, backed by automated scanning. We try to get in, move around and reach your data the way an attacker would.
02
Application security review
Secure code review and OWASP-based testing of web applications and APIs: authentication, access control, session handling and how the application treats the input it's given.
03
Secure coding
Working through the findings with your developers, so the same flaws don't come back in the next release.
Frameworks & platforms we work with
Standards and platforms we work to and on. Not certifications or partner statuses.
- OWASP
- NIST
- AWS
- Azure
- GCP
How an engagement runs
01
Scoping
We agree what's in scope, how we'll test it (black-box, grey-box or with credentials), the dates and the rules of engagement. You sign it off in writing before any testing starts.
02
Testing
We follow recognised methods such as the OWASP Web Security Testing Guide and PTES. If we find something serious, we tell you at the time. It doesn't wait for the report.
03
Reporting
The report opens with a summary for leadership. Then each finding gets a risk rating, evidence, steps to reproduce it and how to fix it. We go through it with you on a call.
04
Retest
Once you've made your fixes, we test those findings again and confirm in writing which ones are closed.
What you receive
- A written report: a summary for leadership, then technical findings rated by risk
- Evidence and remediation guidance for each finding
- A retest of the fixed findings, with written confirmation of what's closed
Start a conversation
Talk to us about penetration testing.
A penetration test, a compliance deadline, a system to build. Tell us where you are and we'll come back to you with how we'd approach it.