Penetration testing
Authenticated, role-aware testing of your application and its API surface, with an account for every role. We chain small findings into the access they lead to, such as a sequential invoice ID and a missing tenant check that together let one customer read another's invoices.
A 45-minute scoping call, signed rules of engagement, a written note after each testing day and a report with an executive summary and one entry per finding, then a free retest of every fixed finding within 30 days of report delivery.
45 minutes
We walk your architecture, agree what matters most and identify what must stay off-limits. There is no discovery invoice and no open-ended estimate.
Fixed quoteProposed datesWritten scope by email
1 to 2 days
Signed authorisation, escalation contacts, testing windows and traffic identifiers. If a critical issue appears mid-test we page you immediately rather than saving it for the report.
Signed RoEEscalation pathTest account provisioning
The testing days in your quote
Testing runs inside the agreed windows and carries the agreed traffic identifiers. At the end of each testing day you get a short written note of what was covered and anything found.
Daily written updatesImmediate critical escalation
2 to 3 days
An executive summary for the board, then one entry per finding with its evidence, how to reproduce it, its severity and the fix.
Full reportExecutive summaryPrioritised fix backlog
Included
A working session with your engineers to walk the findings, plus a shared channel for questions while the fixes are being built. Most disputes about severity get settled here, in front of the evidence.
Walkthrough sessionShared support channel
Within 30 days of report delivery
We retest every finding you have fixed against its original reproduction steps and reissue the report and attestation letter with each finding's current status. The retest is included in the original price.
Updated reportAttestation letter
Web apps, APIs, mobile apps, cloud accounts, networks and AI features, tested by hand and reported with the steps to reproduce each finding.
iOS and Android testing of the binary, on-device storage and transport, and of the backend API the app calls, replaying the app's own tokens to check whether one user can read another's data. On the device we check what the keychain or keystore stores, whether certificate pinning survives a bypass attempt and what deep links can trigger.
Duration: 6 to 10 working days
An IAM-first review of AWS, Azure or GCP. We map what an attacker reaches after compromising one workload or one developer laptop, then rank those paths by the data at the end of each and write the Terraform or policy change that cuts it.
Duration: 4 to 8 working days
Internal and external network testing, including Active Directory. Where scope allows we go from an unauthenticated foothold to domain-wide impact and document the whole chain: the exposed service or sprayed credential that got us in, each privilege escalation on the way, and the accounts and hosts it reached.
Duration: 5 to 12 working days
Adversarial testing of features built on large language models: chat assistants, retrieval-augmented search, agents with tool access, and generated output that reaches users or other systems. We test whether the model can be steered into leaking data, taking actions it should not, or passing untrusted output into the rest of your stack.
Duration: 4 to 10 working days
No tester can promise that nothing will break, so we plan for it. Testing windows and limits on destructive tests are agreed in the rules of engagement before anything starts, and all our traffic carries an identifier your team can filter on. Where a test could write or delete data or send email, we run it against staging and confirm the finding in production only with your sign-off.
Production wherever it is safe, because staging environments rarely reproduce the real access control model, the real data volumes, or the real third-party integrations. Where production is off-limits we test staging and flag explicitly which findings could not be validated.
A report with an executive summary written for non-engineers, and per-finding detail with evidence, severity scoring and specific remediation guidance, plus reproduction steps for anything we exploited. You also get a prioritised fix backlog, a walkthrough session and, after the free retest, an attestation letter you can share with customers and auditors. Every other service lists what you receive on its own page.
The original price includes a free retest of every fixed finding within 30 days of report delivery. Tell us which findings you have fixed; we retest each one against its original reproduction steps and reissue the report. The attestation letter summarises scope, dates, methodology and current status without technical detail, so you can send it to customers and auditors, and anything we have not verified as fixed stays open in it.
A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.