Assessments
Application Security Review
Software penetration testing and secure code review focused on the paths an attacker would take, authentication, authorisation, input handling, secrets and trust boundaries, with findings tied to specific code paths.
Scope
- Authentication and authorisation logic in code
- Input validation and output encoding at trust boundaries
- Secrets handling, cryptography use and dependency risk
- Security-relevant architecture: trust boundaries, tenancy, data flow
Method
Code-assisted review focused on the paths an attacker would take, not a line-by-line audit of the whole codebase. Access via a read-only repository grant or supervised walkthrough, whichever you prefer.
Deliverable
Findings tied to specific files and code paths, each with concrete remediation guidance your engineers can implement directly.
Approach
How we work
01
Scope
Every engagement starts with a scoping conversation and ends that conversation with a written agreement: your target framework or the systems and environments in scope, what is explicitly out, which accounts and data we will use, and the timeline.
02
Assess
We measure where you stand: a gap assessment against your target framework, a review of controls, policies and risk, and hands-on testing where it matters. The work is manual and methodical, guided by how the system is actually used and what an attacker would actually want from it. Tooling supports the work; it does not replace it.
03
Explain
You receive a written report and a walkthrough call. The executive summary is written for people who were not in the room; each finding carries evidence, reproduction steps, business impact and a concrete fix.
04
Verify
When your team has remediated, we retest the affected findings and issue an updated report stating clearly what is resolved, what is partially resolved and what remains open. For a certification programme, we prepare the evidence and stand beside you through the audit, then help you keep it current.
Frequently asked questions
- Do you need access to our source code?
- Yes, via a read-only repository grant or a supervised walkthrough, whichever you prefer. The review is code-assisted and focused on the paths an attacker would take.
- Is this an automated SAST scan?
- No. We use tooling to orient, but the review is manual and targeted at authentication, authorisation, input handling, secrets and trust boundaries, not a line-by-line audit of the whole codebase.
- What do we receive?
- Findings tied to specific files and code paths, each with concrete remediation your engineers can apply directly.
Related reading
Other assessments
Engagements are fixed-scope and fixed-price once agreed. If you are not sure which service fits, whether that is certification readiness, GRC advisory or a penetration test, describe your situation and we will recommend a scope, including telling you honestly if you do not need us yet.