Skip to main content

Web Application & API Security Testing

Automated scanners are good at finding missing headers. They are poor at noticing that one customer can read another customer’s invoices by changing a number in a URL. That second kind of problem is where most serious application risk sits.

We test your application and its APIs manually, with tooling in support, and focus on the flaws that matter to your users and your data.

What we test

  • Authentication weaknesses
  • Authorisation and access-control flaws
  • IDOR and broken object-level authorisation (BOLA)
  • Session and token handling
  • Injection vulnerabilities
  • API endpoint security
  • Input validation
  • Business logic vulnerabilities
  • Sensitive data exposure
  • Security misconfiguration

Testing is referenced to the OWASP Top 10 and the OWASP API Security Top 10, applied to what is relevant for your application rather than as a checkbox exercise.

What you receive

  • An agreed scope and testing approach, in writing, before testing starts
  • Findings with evidence and risk ratings
  • Reproduction steps, where it is safe to include them
  • Remediation recommendations for each finding
  • Optional retesting of fixed findings, by agreement

Scope and limitations

  • Every engagement is scoped individually. Depending on that scope, the work may be a focused security assessment rather than a full penetration test, and the report says which.
  • Testing only covers the systems, accounts and time window agreed in writing.
  • We prefer a staging environment and test accounts, and do not need production credentials.

Common questions

Is this a penetration test?

It can be. Some engagements are a full penetration test of an application; others are a focused assessment of specific features or APIs. We agree which before work starts and the report states it plainly.

What do you need from us?

A description of the application, the environments in scope, and usually two or more test accounts with different roles so access between users can be tested properly.

Will the report satisfy our compliance requirement?

A security assessment can support a compliance programme, but it is not a certification. If you need a report in a specific format for an auditor or customer, tell us at the start.

Start a conversation

Ready to talk about scope?

Tell us what you would like reviewed and when you need it. We will reply with questions or a proposed scope and a fixed quote. An enquiry is not authorisation to test anything.

Request a quote