01
Web applications
Authentication, session handling, authorisation, input validation and business logic.
Penetration Testing
We look at your systems the way an attacker would, and help you close the gaps before anyone uses them.
What it is
A penetration test is a controlled attack that shows how well your systems hold up against a real one. We do not stop at what scanners find: we test by hand for the problems only an expert can see, such as broken access control, business logic flaws and chained attacks. You end up with a report that shows what is really at risk and how to fix it.
What we cover
0602
Mobile apps
Data storage, transport security and back-end APIs of iOS and Android apps.
03
APIs
Object-level authorisation, rate limiting and data exposure in REST and GraphQL services.
04
External network
Internet-facing servers, services, VPN and remote access.
05
Internal network
How far an attacker inside your network could get; covered in depth by the Active Directory test.
06
Black, grey, white box
Testing with no information, some information or full access.
How we work
- 01
Scope and permission
Systems, time window and rules of engagement are agreed in writing.
- 02
Reconnaissance
Open services, technologies and the attack surface are mapped.
- 03
Testing and exploitation
Automated scans and expert testing; we check whether each finding can really be exploited.
- 04
Reporting
Findings are ranked by risk, each with the steps to fix it.
- 05
Retest
Once fixes are in, we test again and report the result.
What you get
- Executive summary: risks and priorities in plain language
- Technical report: evidence, impact, CVSS score and fix for every finding
- A prioritised action list
- A retest report for the fixed findings
When you need it
- Before launching a new application or a major release
- When a customer, auditor or partner asks for a penetration test report
- As part of PCI DSS, ISO/IEC 27001 or similar compliance work
- After a security incident, to confirm the gap is closed
Methodologies & Standards
OWASP WSTGOWASP Top 10OWASP API Security Top 10OWASP MASVSPTESNIST SP 800-115CVSS v4.0
Frequently Asked
Tests run within an agreed scope and time window. Anything that could disrupt service is discussed with you first and, if you prefer, done on a test environment or out of hours.
A vulnerability scan lists known issues with automated tools. In a penetration test an expert tries those findings, and the logic flaws tools cannot see, by hand, showing whether a gap can really be exploited and how far an attacker could get.
Common practice is at least once a year and after every major change. The standard or regulation you follow may require more frequent testing.
Yes. We fix the findings together with your team or do the fixes ourselves, then retest to confirm each gap is really closed.
More services in Cybersecurity
All ofCybersecurity- Source Code ReviewWe find vulnerabilities in the code itself, while it is still being written.
- Wireless (Wi-Fi) Security TestingWe test how exposed your office and guest Wi-Fi are to someone sitting in the car park.
- DDoS Resilience TestingWe measure, in a controlled way, whether your site and app stay up under heavy attack traffic.
- Phishing SimulationWe send your staff realistic fake e-mails, then raise awareness with short training.
- Active Directory and Internal Network TestingWe show how quickly an attacker inside your network could get from one laptop to the whole company.
- Cloud Security ReviewWe find public storage, excessive permissions and risky settings in your cloud accounts before an attacker does.
