01
Who can access your accounts and data?
Assess authentication, sessions and permissions across users, roles and organisations, including the controls around sensitive information and actions.
Web application penetration testing
Confidence in your next
application release.
A new release or customer review brings questions about your application’s security. We test the agreed workflows and permissions, then explain what needs attention and how your team can address it.
Private, self-hosted AI assistance. Assessment material is not sent to third-party model providers for that assistance.
Questions your test can answer
Test the controls.
Understand the implications.
The OWASP Web Security Testing Guide is our baseline. We build on it with specialist testing tailored to your application’s architecture, technology and business logic.
02
How safely does your application handle input?
Assess input handling for SQL and command injection, cross-site scripting and related weaknesses that could expose data or compromise application behaviour.
03
Do important workflows enforce your rules?
Examine the business logic behind approvals, transactions and account changes to identify unintended actions and gaps in the rules your business relies on.
04
Are files and connected features protected?
Assess uploads, downloads, application APIs and integrations for weaknesses in how information is processed, shared and accessed.
05
Could browser behaviour expose sensitive information?
Review client-side code, browser storage and data handling, including information exposed through error messages and browser security settings.
06
Does your deployment support your security?
Assess your application’s web server, CDN and cache configuration, including transport security, security headers and the handling of private content.
Your assessment output
Evidence for your team.
Clarity for your reviewer.
Your report includes an executive summary, a summary of findings and detailed findings with descriptions, reproduction steps, remediation steps and references. A readout helps your team understand the priorities and next steps.
Your assessment report
Clear findings.
A useful next step.
Executive summary
Key findings & implications
Summary of findings
An overview of the issues
Finding details
Understand, reproduce & remediate
Each detailed finding includes a description, reproduction steps, remediation steps and references.
Getting started
Bring the context.
We’ll shape the scope.
Bring a product overview, the roles you want assessed, a representative environment and the release or customer review driving the test.
Let’s talk through
your penetration test.
Tell us about your product, your deadline and the evidence your reviewer needs. We’ll agree the scope and handling arrangements before work starts.