We test your web applications and the APIs behind them the way an attacker would: without an account, logged in as each of your roles, and as one customer trying to reach another customer's data.
Scanners find some of the problems. Broken access control and business logic flaws, which tend to do the most damage, usually turn up only when a person works through the application by hand.
Login, password reset, multi-factor authentication, session handling and tokens, including what happens when a token is replayed, reused or forged.
Whether each role and each tenant sees only what it should. We look for horizontal and vertical privilege escalation across every function in scope.
SQL, command and template injection, cross-site scripting, file uploads and anything else that takes input and trusts it.
Steps that can be skipped, repeated or done out of order, prices and limits that can be changed, and workflows that assume every user plays by the rules.
Every endpoint in scope, including the ones the front end never calls. We check authorisation on each object and field, rate limits and what the API gives away in its error messages.
Security headers, TLS, cookies, error handling and third-party libraries with known vulnerabilities.
Each finding comes with the evidence behind it, a CVSS rating, the business impact and a concrete fix. Where it applies, that includes the requests and responses or the configuration details that show the problem. It's written so you can pass it to an engineer unchanged.
Two pages in plain language on the business impact and the priorities, written for your board or your customer's security team.
A working session with your engineers where we go through the findings, answer questions and agree how to prioritise the fixes. We can record it if you like.
Staging, if it matches production closely. That lets us test harder without putting live data at risk. If staging differs in ways that matter, such as its configuration or missing integrations, we test production within limits and time windows we agree with you.
Yes, for anything behind a login. We ask for at least two accounts per role, and two separate tenants if the application has them, so we can check that one user can't reach another user's data.
A single web application usually needs about five testing days, and an application with a large API takes longer. We give you a fixed timeline once we've agreed the scope.
Yes. We use scanners to cover the basics quickly, then spend most of the time testing by hand, because access control and business logic flaws rarely show up any other way.
Book a scoping call, and we'll send you a fixed quote as soon as we've agreed what to test.