Find out what can actually be exploited.
Testing that shows which weaknesses can actually be used against you, with the evidence.
In this practice
- Web Application VAPTYour web application tested the way an attacker would approach it.
- API Security TestingYour APIs tested for what they return, and to whom.
- Network Security TestingYour network tested for what is reachable that should not be.
We work to: OWASP Web Security Testing Guide, OWASP API Security Top 10, PTES (Penetration Testing Execution Standard).
We follow the path an attacker would.
From the internet, through your application and its APIs, into your network, toward the data. Each test covers one stretch of that path.
- Internet
- Web Application VAPTAn injection flaw or broken access control.
- API Security TestingAn endpoint returning another user’s data.
- Network Security TestingAn exposed admin port.
- Your data
The problem
A scanner tells you what might be wrong. It does not tell you what someone could do with it.
Vulnerability assessment
Finds and lists the weaknesses across what is in scope. Wide coverage. Answers “what is wrong here?”
Penetration testing
Tries to use those weaknesses, as an attacker would, to show what they lead to. Answers “does it matter?”
You need both. The first without the second gives you a long list and no priorities. The second without the first gives you one path and no coverage.
How a test runs.
Scope.
Targets, limits and testing windows, agreed with you before anything is touched.
Test.
Assessment first, then exploitation of what the assessment turns up.
Report.
Findings ranked by risk, each with evidence and what to change.
Review.
We go through the findings with the engineers who will fix them.
What you have at the end.
- Proof of which weaknesses can be exploited, and which cannot.
- Findings ranked by risk, with evidence.
- Fix guidance written for the people doing the fixing.
Questions we get asked.
Will testing disrupt our production systems?
Targets, limits and testing windows are agreed with you before any testing starts. Nothing outside that scope is touched.
Can we test only the API, or only the web application?
Yes. The three tests can be taken separately. If you are not sure which matters most, tell us what you run and we will recommend one.
What do we receive?
A report of findings ranked by risk. Each one has the evidence for it and guidance on the fix.
Tell us what you want tested.
An application, an API, a network. A few lines is enough to scope it.