Penetration Testing
Manual, adversarial testing of your applications, APIs and infrastructure. We chain small weaknesses into the routes an attacker would actually take, prove each one with evidence, and retest your fixes.
When it's needed
A penetration test is most useful at a moment of change or scrutiny, and when it's scoped to what's actually at risk rather than to a checklist.
- Before launching a product or a major feature
- When a customer, partner or auditor asks for an independent test
- After significant changes to authentication, payments or infrastructure
What we test
- Web applications
- Authentication, authorization, session handling and business logic.
- APIs
- Object-level access, input handling and abuse of legitimate functions.
- Mobile applications
- The app, its local storage and the APIs behind it.
- External infrastructure
- Internet-facing hosts, services and misconfigurations.
- Internal networks
- Lateral movement and privilege escalation from an assumed foothold.
- Cloud environments
- Exposed services and identity paths in AWS, Azure and GCP.
How we work
- 01
Discover
Agree targets, rules of engagement and testing windows, then map entry points.
- 02
Validate
Test manually and reproduce every finding with evidence.
- 03
Prioritize
Chain related issues into attack paths and rank them by exploitability and impact.
- 04
Reduce
Walk your engineers through fixes and retest them.
What you get
- Validated findings, with fixes
- Each proven with evidence, and a code or configuration-level fix for your stack.
- Attack-path narrative
- How individual issues chain together, and what an attacker could reach.
- One retest within 90 days
- We confirm each fix and update the report.
- A report for the record
- Scope, methodology and an executive summary for customers and auditors.
Common questions
Ask us something elseBlack, grey or white box: which should we choose?
Grey box usually gives the most value for the time: we test with accounts and some documentation, as an attacker with a foothold would. Black box shows your exposure as an outsider sees it. We'll recommend one during scoping.
What do you need from us to get started?
To start, we usually need a list of in-scope targets: URLs, APIs, IP ranges; a staging environment that mirrors production; test accounts for each user role; and a contact we can reach during testing hours. We confirm the exact list during scoping.
Will testing affect production?
We agree rules of engagement before starting, including testing windows and systems that are off limits. Destructive tests only run against staging unless you ask otherwise.
When do we see results?
Findings are shared as they are confirmed, so serious issues reach you during the test rather than weeks later. The full report follows at the end.
Related services
Not sure where to start?
Tell us what you're building and what worries you. We'll recommend the smallest engagement that answers it.