Services · Penetration testing
Penetration testing, with a report you can act on
We test your web applications, APIs and external network the way an attacker would, only on targets you authorize in writing. You get a report that ranks each finding by what to fix first, and a retest of the fixes.
What is penetration testing?
Penetration testing is a controlled attempt to break into a system, run with the owner's written permission, to find weaknesses before a real attacker does. The result is a report of what was found, how it was reached and how to fix it.
What you get
Who it’s for
Teams shipping a web application or API, or exposing systems to the internet, who want it tested before someone else tests it.
- 01A written scope and a signed authorization before any test runs
- 02Web application and API testing: login, sessions, access control and common weaknesses
- 03External network testing of the systems you expose to the internet
- 04A report with every finding, how we reached it, its risk and the fix, ranked by what to fix first
- 05A retest of the fixed findings, noted in the final report
A test is only as useful as its report
Finding a weakness is half the job. The other half is telling your developers exactly how it was reached, how serious it is and how to close it, in words they and the business can both use.
Testing is performed only with written authorization, inside the scope and time window we agree. We cannot guarantee that every weakness is found, so the report states what was and was not covered.
| Test | What it examines | Typical question it answers |
|---|---|---|
| Web application | Your site or app, as a logged-out and logged-in user | Can a user see or change another user's data? |
| API | The endpoints your apps and partners call | Can the API be used in ways you did not intend? |
| External network | Systems reachable from the internet | What would an outsider find exposed? |
| AI system | Agents and assistants that act on your behalf | Can the agent be tricked into leaking data or taking an action? |
How it works
Scope and authorization
We agree the targets, the dates and the rules in writing. Nothing runs before you sign.
Test
We test inside the scope, tell you immediately about anything serious and keep notes on every step.
Report and retest
You get the ranked report, we walk your team through it, and we retest what you fixed.
Pricing
The first call is free. Custom work is quoted in writing before anything starts. Pricing depends on scope and volume, and we quote it in writing.
Questions
- Do you do web application penetration testing?
- Yes. Web application and API testing is the most common engagement, covering login, sessions, access control and common weaknesses.
- Do you do network and external penetration testing?
- Yes, for the systems you expose to the internet, inside an agreed scope and time window.
- What is vulnerability assessment and penetration testing (VAPT)?
- VAPT combines a search for known weaknesses with attempts to use them. We scope both together when you want a broad picture and proof of impact.
- What is the difference between a vulnerability assessment and a penetration test?
- An assessment looks for known weaknesses, often with scanners. A penetration test goes further and tries to use weaknesses the way an attacker would, to show what they allow.
- Do you test without permission?
- Never. We test only systems you own or have the written right to authorize, inside the agreed scope and dates.
- Can you break our production system?
- We plan tests to avoid disruption and agree the rules first, but any test carries some risk. We discuss it in the scope.
- Do you guarantee you will find everything?
- No. We report what we found, how we found it and what was not covered.
- Does the report satisfy a compliance requirement?
- That depends on the requirement. Tell us what you need to show, and we say honestly whether our report can serve it. We make no certification claims.
- How is it priced?
- The first call is free. Testing is priced by scope, in writing before we start.
Tell us what you want tested
Book a free 30-minute call. We agree what is in scope, put the authorization and the scope in writing, and quote the work before anything runs.