// 01 SECURITY
Penetration Testing
Web, API, mobile and network testing by a human, not just a scanner.
A controlled, authorised attack on your application or network to find vulnerabilities a real attacker would use — before they do.
What's included
- Web application testing (OWASP Top 10)
- API testing
- Authentication and session review
- Business-logic testing
- Network / external infrastructure testing
- Optional mobile app testing
Our methodology
- 1Reconnaissance and scoping: confirm targets, environment and rules of engagement in writing before any testing begins.
- 2Automated discovery: a baseline scan for known vulnerabilities and misconfigurations, used to guide manual testing — not as the deliverable itself.
- 3Manual exploitation: hands-on testing against OWASP Top 10 categories, authentication, session handling and business logic that scanners miss.
- 4Safe validation: findings are proven with evidence (screenshots, requests, logs) without destructive techniques against production data.
- 5Reporting and re-test: findings are written up by severity, then re-tested free of charge once you have applied fixes.
What you get
- Executive summary for management
- Technical findings with severity (CVSS), proof and fix steps
- Free re-test after remediation
- Letter of attestation
What to expect
- A clear, CVSS-rated list of what's actually exploitable — not just what a scanner flagged.
- A report you can hand to your own developers, a client, or an auditor without translation.
- Confirmation that your fixes actually closed the gap, via the included re-test.
Limitations
Honest scope, not a sales pitch — here's what this service doesn't cover.
- A penetration test reflects your security posture at the time of testing — new code or configuration changes afterward are not covered until the next test.
- Testing is limited to the scope and systems agreed in writing; anything outside that scope is not tested.
- No test, automated or manual, can guarantee a system is 100% secure — the goal is to close as many real, exploitable gaps as possible within the agreed scope.
FAQ
Will testing break my site?
We agree test windows and avoid destructive techniques. Production testing is optional; staging is preferred.
How long does it take?
Typically 5-10 working days for a standard web app, depending on scope.
Automated scan or manual?
Manual testing supported by tools. Scanner-only reports miss logic flaws.
// PROCESS
How this engagement works
- // 01
Free consultation
30 minutes to understand your setup and concerns.
- // 02
Scoped proposal
Fixed scope, fixed price, clear timeline. NDA signed before any access.
- // 03
Testing & review
We test safely, with written authorisation, inside agreed boundaries.
- // 04
Report & fix
Plain-language report, prioritised by risk, and a free re-test after you fix.
Authorisation & safety
Every engagement starts with written authorisation and, where appropriate, a signed NDA — we never test a system without the owner’s explicit permission. Testing is scoped and scheduled with you in advance, avoids destructive techniques by default, and stays inside the boundaries agreed before any work begins.
// FROM THE BLOG
Further reading
AI Agent Security: How to Secure Autonomous AI Agents With Access to Your Systems
AI agents are no longer just chatbots — they call APIs, execute code, and take actions on your systems. Here is the new attack surface that creates, and how to actually secure it.
Cybersecurity for AI Applications: A Practical Security Checklist for Businesses
Authentication, prompt injection, tool permissions, data isolation and twelve other areas to check before an AI application goes into production — a practical checklist, not a theoretical framework.
AI Red Teaming: How to Stress-Test Your AI Systems Before Attackers Do
If your business has built or deployed an AI application, it needs adversarial testing the same way your web application needs a penetration test. Heres how AI red teaming works, and the OWASP framework most teams test against.
API Security in 2026: OWASP API Top 10 and the Rise of Agentic Risk
APIs are now called by AI agents as often as by people. Here is what the OWASP API Security Top 10 covers, why it still matters, and what changes when software calls your API instead of a human.
IoT Security in 2026: NIST's Updated Guidance for Connected Devices
NIST is updating its core IoT device cybersecurity guidance in 2026, and the EU is imposing new reporting obligations from September 2026. Here is what that means for anyone deploying connected devices.
OWASP Top 10:2025 Explained: What Changed and Why It Matters
OWASP released its first Top 10 update since 2021 in November 2025. Here is what actually changed, in plain English, and what it means for your next security review.
Prompt Injection Attacks Explained: How Attackers Manipulate AI Applications
OWASP ranks prompt injection as the top risk to LLM applications. Here is how direct and indirect prompt injection actually work, with a real zero-click incident, and how to defend against it.
Ready to talk through your scope?
Book a free consultation. No obligation, no pressure.