Services
Testing that goes where scanners can't.
Automated tools are part of how we work, but they're not the work. The issues that matter most, like broken access control, tenant leaks and logic flaws, take people who understand how your application is meant to behave and then try to make it misbehave.
Every engagement is a time-boxed test of an agreed scope. We can't promise to find vulnerabilities, or that none remain afterwards, and every report states exactly what was and wasn't covered. No guarantee of findings.
Web application penetration testing
A hands-on test of your application from the outside in, signed in as each role you give us. Built on the OWASP Web Security Testing Guide and mapped to ASVS.
- Typical testing time
- 5–10 days
- Approach
- Grey box (accounts + docs)
- Good for
- SOC 2, ISO 27001, launches
What we test
- Authentication & sessionsSign-in, MFA, password reset, session lifetime and invalidation, SSO and OAuth flows.
- Authorisation & tenant isolationCan a user reach another user's or another organisation's data? Can a regular user do admin things?
- Input handlingInjection, cross-site scripting, file uploads, deserialisation and server-side request forgery.
- Business logicWorkflows that can be skipped, repeated, raced or reordered: payments, invites, approvals, limits.
- Client-side securityContent Security Policy, token storage, third-party scripts, postMessage and clickjacking.
- ConfigurationSecurity headers, TLS, cookies, error handling, exposed debug and admin surfaces.
You receive
- Full technical reportEvery finding with severity, impact, reproduction steps, evidence and remediation.
- Executive summaryTwo pages for leadership, auditors and customers.
- Readout call & retestWalk through the results with your engineers, then we verify your fixes.
API security testing
REST and GraphQL APIs, public or internal, tested against the OWASP API Security Top 10. We start from your specification and then test what the implementation actually does.
- Typical testing time
- 4–10 days
- We'll need
- Spec or collection + keys
- Good for
- Partner APIs, mobile backends
What we test
- Object-level authorisationThe most common serious API flaw: reaching records that belong to someone else by changing an identifier.
- Function-level authorisationAdmin or internal operations reachable by ordinary API consumers.
- Authentication & tokensAPI keys, OAuth scopes, JWT validation, token lifetime and revocation.
- Data exposure & mass assignmentFields returned that shouldn't be, and fields accepted that shouldn't be writable.
- Resource consumptionMissing rate limits, unbounded pagination, expensive GraphQL queries. Assessed safely, without overloading production.
- IntegrationsWebhooks, callbacks, server-side fetches and third-party API trust.
You receive
- Technical reportFindings tied to specific endpoints and operations, with the requests to reproduce them.
- Specification drift notesWhere the API behaves differently from its documentation.
- Readout call & retest
Source code review
A security-focused read of your codebase by people who write software. We concentrate on the paths that decide who can do what, and pair manual review with dependency and secret analysis.
- Typical review time
- Depends on codebase size
- Access
- Read-only, deleted after
- Good for
- Pre-launch, critical services
What we review
- Access controlEvery place a permission decision is made, and every place one should be but isn't.
- Authentication & session codeCredential handling, token generation and validation, session storage.
- CryptographyAlgorithm choice, key management, randomness, and how encrypted data is actually used.
- Input to sinkUntrusted data traced to queries, templates, file paths, shell calls and deserialisers.
- Secrets & dependenciesCommitted credentials, vulnerable packages that are actually reachable, risky build steps.
You receive
- Code review reportFindings with file and line references, a suggested patch where it's practical, and severity in context.
- Secure-coding sessionAn hour with your engineers on the patterns behind the findings.
Security audits
A structured review of how your application is designed, configured and built, measured against OWASP ASVS or the framework you're working towards. The output is a plan, not just a score.
- Typical duration
- 1–3 weeks
- Format
- Interviews, docs, config review
- Good for
- Compliance readiness
What we look at
- Architecture & data flowsTrust boundaries, where sensitive data lives, how services authenticate to each other.
- ConfigurationApplication, framework, identity provider and deployment settings.
- Development processCode review, dependency management, secrets handling, CI/CD and release controls.
- Logging & responseWhether you would notice an attack, and what happens next.
You receive
- Audit report & gap analysisAgainst ASVS levels or your chosen control set.
- Prioritised roadmapWhat to fix first, what can wait, and roughly what each costs.
Cloud & infrastructure review
The accounts and services your application runs on, reviewed with read-only access against CIS benchmarks and provider best practice, alongside your external attack surface.
- Typical duration
- 3–8 days
- Access
- Read-only audit role
- Providers
- AWS, GCP, Azure
What we review
- Identity & accessOver-privileged roles, long-lived keys, cross-account trust, missing MFA.
- Network exposureWhat's reachable from the internet that shouldn't be, and how segments connect.
- Data storagePublic buckets, unencrypted volumes, database exposure, backup access.
- Logging & monitoringAudit trails, alerting and retention.
- Edge & emailTLS configuration, DNS hygiene, SPF, DKIM and DMARC.
You receive
- Findings reportEach with the resource affected, the risk and the configuration change to make.
- Readout call & retest
Retesting & attestation
Fixing a finding and fixing it properly aren't always the same thing. We retest each one, update its status in your portal, and document the outcome.
- Included
- One retest with every test or review
- Window
- Within 90 days of the report
- Standalone
- For other firms' reports too
You receive
- Retest reportEvery original finding marked fixed, partially fixed or still open, with fresh evidence.
- Attestation letterA shareable letter confirming scope, dates and outcome, without exposing finding details.
- Updated portal statusYour Engagements view shows resolved versus open findings by severity.
Not sure which one you need?
Tell us what's driving the question, whether it's a customer questionnaire, an audit, a launch or a worry, and we'll recommend the smallest engagement that answers it.