Test it before
someone else does

A web application penetration test is an authorised, simulated attack against your application to identify security vulnerabilities before real attackers do. We use the same techniques as attackers, but with your explicit permission and within an agreed scope. You receive a detailed report with every finding, its severity, and step-by-step remediation guidance.

Most web application penetration tests run 3 to 10 business days depending on the size and complexity of the scope. A single application with a moderate number of endpoints typically takes 5 days. We provide a scoping call before any engagement to give you an accurate estimate.

Yes. We follow the OWASP Testing Guide and OWASP API Security Top 10 as our baseline methodology. Our testing combines automated scanning with extensive manual verification to catch business-logic vulnerabilities and chained attack paths that scanners miss entirely.

You receive a comprehensive report covering: an executive summary suitable for non-technical stakeholders, a technical findings section with every vulnerability (severity, CVSS score, steps to reproduce, evidence screenshots), and a remediation guide with prioritised fix recommendations. We also offer a debrief call to walk through the findings with your engineering team.

We work with businesses of all sizes, from early-stage startups preparing for a funding round to established SMEs and mid-market SaaS platforms. Engagements are scoped to your specific environment, not a one-size-fits-all package. We've worked with solo-founder products and 200-person engineering teams alike.

Pricing depends entirely on scope: the number of applications, endpoints, features, and testing objectives. A focused web application test for a mid-size SaaS typically starts at a few thousand dollars. We provide a firm quote after a free scoping call. There are no hidden extras: the quoted price includes the report, the debrief call, and a retest of critical findings.

Yes. We sign a mutual NDA and a formal Rules of Engagement document before any testing begins. No data collected during an engagement is retained after the report is delivered, and all testing is conducted under written authorisation. Your application details and findings are never shared with third parties.

Yes. Every engagement includes a free retest of critical and high findings after remediation. This confirms the fix is effective and not bypassable. Additional retests for medium and low findings are available at a reduced rate for existing clients.

No, not if scoped properly. We agree on testing windows before the engagement begins, typically avoiding peak business hours. For production environments, we can limit impact-heavy tests or run them against a staging environment. Most findings are identified through careful manual analysis, not disruptive exploitation.

Yes. Penetration testing is a mandated or strongly recommended control in PCI-DSS 11.4, ISO 27001 Annex A.12.6, SOC 2 CC6, and GDPR Article 32. Our reports are structured to support compliance evidence requirements, and we can provide a compliance mapping document on request to simplify your audit process.

It depends on the testing type. For black-box testing, you provide the target URL and written authorisation. For grey-box (most common for web apps), we need test accounts at different privilege levels. For white-box, we may request API documentation or architecture diagrams. We confirm requirements on the scoping call. Nothing starts until both parties agree to the scope in writing.

Typically a technical point of contact (lead engineer or DevOps lead) for day-to-day coordination, and a business stakeholder (CTO, CISO, or founder) for the scoping call and report debrief. We adapt to your team structure. Some clients also include their compliance officer or legal team at kickoff.