Assessments
Web & API Testing
Web application and API penetration testing (VAPT) that finds the exploitable flaws automated scanners miss, manual testing of authentication, authorisation, business logic and API-specific risks, with reproducible findings and a retest of the fixes.
Scope
- Authentication, session management and account recovery flows
- Authorisation: role, tenant and object-level access control
- Input handling: injection, file handling, deserialisation
- Business-logic abuse: workflow bypasses, race conditions, payment and quota logic
- API-specific concerns: excessive data exposure, mass assignment, rate limiting
Method
Primarily manual testing with purpose-built tooling where it helps. We test with agreed accounts against agreed environments, and we never run destructive or availability-impacting checks without explicit sign-off.
Deliverable
A written report with an executive summary, reproducible findings (exact requests, affected routes, evidence), and remediation ordered by real risk. A retest of fixed findings is included when agreed in scope.
Approach
How we work
01
Scope
Every engagement starts with a scoping conversation and ends that conversation with a written agreement: your target framework or the systems and environments in scope, what is explicitly out, which accounts and data we will use, and the timeline.
02
Assess
We measure where you stand: a gap assessment against your target framework, a review of controls, policies and risk, and hands-on testing where it matters. The work is manual and methodical, guided by how the system is actually used and what an attacker would actually want from it. Tooling supports the work; it does not replace it.
03
Explain
You receive a written report and a walkthrough call. The executive summary is written for people who were not in the room; each finding carries evidence, reproduction steps, business impact and a concrete fix.
04
Verify
When your team has remediated, we retest the affected findings and issue an updated report stating clearly what is resolved, what is partially resolved and what remains open. For a certification programme, we prepare the evidence and stand beside you through the audit, then help you keep it current.
Frequently asked questions
- Do you test production or staging?
- We test whatever environment you authorise in writing, usually a staging or pre-production copy with representative data. We never run destructive or availability-impacting checks against production without explicit sign-off.
- How is this different from a vulnerability scan?
- A scan is automated and flags known signatures; our testing is primarily manual, so we find business-logic flaws, broken authorisation and chained exploits that scanners miss. Tooling supports the work, it does not replace it.
- Do you retest after we fix the findings?
- Yes, a retest of the fixed findings is included when agreed in scope, and we issue an updated report stating what is resolved, partially resolved or still open.
Related reading
Other assessments
Engagements are fixed-scope and fixed-price once agreed. If you are not sure which service fits, whether that is certification readiness, GRC advisory or a penetration test, describe your situation and we will recommend a scope, including telling you honestly if you do not need us yet.