APPLICATION SECURITY TESTING
AI-driven threats are relentless, evolving every second. We investigate real attack paths, explain what matters, and help turn security findings into fixes.
Services
Web security and penetration testing are all we do. Each test is scoped to how your system is built and carried out by hand, with automated tools in support.
Manual testing of your website, customer portal or SaaS product. We check login and sessions, whether one user can reach another user's data, injection, file uploads and the business rules automated tools can't reason about.
Let's DiscussREST and GraphQL APIs, including the ones behind your mobile app. We call every endpoint directly, with and without valid tokens, so checks that only exist in the front end are caught.
Let's DiscussEverything you expose to the internet: domains, subdomains, IP ranges, mail and VPN gateways, forgotten admin panels. We map what's reachable and what an outsider could use as a way in.
Let's DiscussAWS, Azure and Google Cloud accounts checked for over-broad IAM roles, public storage, leaked secrets and missing logs. These are the settings that turn a small bug into a large breach.
Let's DiscussiOS and Android apps tested on a real device and against their back end. We look at what the app stores locally, how it handles certificates and what happens when someone tampers with it.
Let's DiscussA focused read of your React, Node.js or Next.js code around the risky parts: auth, payments, file handling and data access. Each issue comes with the file, the line and a suggested patch.
Let's DiscussWhy manual testing
Scanners are good for coverage. Serious web breaches usually come from flaws they can't see: broken access control, logic errors and small issues chained together.
Process
Four stages, each with a clear output, so you always know where the test stands.
Scope
We agree targets, test dates, test accounts and rules of engagement in writing. Testing starts only after the system owner signs the authorisation.
Output: signed scope and authorisation
Test
We work through the agreed scope using OWASP and PTES methods. If we find something critical, we tell you the same day.
Output: same-day alerts for critical issues
Report
A plain-English summary for leadership, then every finding with evidence, a CVSS score and step-by-step fixes for your developers.
Output: summary plus technical findings
Retest
When your fixes are live, we test each finding again and update the report, so you can show customers and auditors the gaps are closed.
Output: updated report with retest results
Example finding
Each finding names what's affected, shows the evidence, scores the risk with CVSS 3.1 and tells your developers what to change. The example here is illustrative.
Broken access control on the invoice API
Any signed-in customer can read another customer's invoices, and change their billing email, by editing the invoice ID in the request.
Engagements
Most clients start with a one-off test. Teams that release often move to regular testing.
One-off test
A single test before a launch, a funding round, a customer's security review or an ISO 27001 or SOC 2 audit. You get the price and the number of test days before anything starts.
Retainer
Regular testing for teams that release often. New features are tested as they ship, there is a full test each year, and you keep one point of contact who already knows your system.
Fractional
A part-time security lead for teams without one. We threat-model new features, review risky pull requests and help you answer customer security questionnaires.
FAQ
A scan runs automated checks and reports anything that matches a known issue. A penetration test is a person working through your system like an attacker would, confirming what's real, testing logic and access control, and showing how far one weakness can be taken.
Yes. Testing a system without authorisation is an offence under the Computer Misuse Act 1990. We agree the scope in writing and the system owner signs it before we start. If a third party hosts your app, we help you check their testing rules.
We avoid destructive tests by default and agree anything risky with you first. If you prefer, we can test a staging copy that matches production.
It depends on the size of the system. Most web application tests take between a few days and two weeks. The quote states the exact number of test days before anything starts.
A report with a plain-English summary for leadership and a technical section for developers. Each finding has evidence, a CVSS 3.1 score and fix steps. After the retest you get an updated version showing what is closed.
At least once a year, and after major changes such as a new feature that handles payments or personal data, a new API, or a move to new infrastructure. Many clients also test before a customer security review or a certification audit.
Know where you stand
Get a clear assessment of your attack surface, real-world risks and the changes that matter most.
Contact
Send a few details about the system and your deadline. We'll come back with scope questions and a fixed quote. No discovery call needed to get a straight answer.