Service
Penetration Testing (VAPT)
Real humans break it before anyone else does, and prove exactly how.
Penetration testing is a hands-on security assessment where our testers attempt to exploit your systems the way a real attacker would, rather than just running a scanner and forwarding the output. We validate every finding with a real payload and chain small issues into the ones that actually matter.
It is the evidence auditors, customers and your own board ask for, and it feeds directly into the controls that frameworks like SOC 2, ISO 27001 and PCI DSS expect.
What we test
Web applications
Business logic, access control, authentication and the OWASP Top 10, tested by hand rather than scanned.
APIs
REST, GraphQL and gRPC, against the OWASP API Top 10, including broken object-level authorisation.
Cloud
AWS, Azure and GCP configuration and exploitation, mapped to real attack paths.
Mobile
iOS and Android apps end to end, against the OWASP MASVS.
AI and LLM
Prompt injection, data leakage and agent abuse, against the OWASP LLM Top 10.
Identity and network
Authentication, privilege escalation and lateral movement across internal and perimeter networks.
Standards we test to
What's included
- Manual testing of web apps, APIs, cloud and identity
- Business-logic, access-control and authentication testing scanners miss
- Reproducible findings with evidence, impact and a CVSS rating
- A prioritised remediation plan your engineers can act on
- One free retest of the fixes
What you walk away with
- A clear picture of what an attacker could actually do
- Evidence you can hand to auditors and customers
- Fixes that are verified, not just reported
How it runs
Scope
We agree the targets, rules of engagement and goals up front, with a fixed scope and a fixed quote.
Test
We test by hand across every surface, chaining weaknesses to prove real impact rather than theoretical risk.
Prove
Every finding is reproducible, with evidence, impact and a CVSS rating. Signal, not scanner noise.
Retest
You fix, we re-run the exploit to prove it is closed. The retest is part of the engagement.
How much we start with
Black box
The external attacker
We start with no inside knowledge, the way an outsider would, to test your real external attack surface.
Grey box
The compromised user
We start with a standard account, to see how far a logged-in user or a phished employee could get. The usual choice for production SaaS.
White box
Maximum coverage
We start with full information and source access, for the deepest coverage on pre-production or high-assurance systems.
Manual testing vs an automated scan
Both have a place, but auditors and attackers both care about the difference.
| Manual penetration test | Automated scan | |
|---|---|---|
| Business-logic flaws | Found | Missed |
| Every finding validated by hand | Yes | No |
| False positives | Rare, each is proven | Common |
| Chained, real-world impact | Yes | No |
| Audit evidence auditors accept | Yes | Rarely on its own |
What this supports
A manual penetration test feeds directly into the controls these frameworks expect, and is often explicitly required.
- ISO 27001
- Evidence for control A.8.8, the management of technical vulnerabilities.
- SOC 2
- Security-testing evidence auditors look for under the Trust Services Criteria.
- PCI DSS
- Requirement 11, regular penetration testing of the cardholder data environment.
- HIPAA
- Supports the Security Rule's evaluation and risk-analysis expectations.
FAQ
- What is the difference between a vulnerability scan and a penetration test?
- A scan lists potential weaknesses automatically. A penetration test is manual: we exploit and chain them to prove real impact, and find the business-logic and access-control flaws scanners cannot.
- Does a penetration test help with compliance?
- Yes. The evidence feeds directly into SOC 2, ISO 27001, PCI DSS and similar frameworks, and is often explicitly required.
- Is the retest included?
- Yes. Once you have fixed the findings, we re-run the exploit to prove they are closed. It is part of the engagement, not an upsell.
Related services
Related reading
How to Read a Penetration Test (VAPT) Report: A Plain-English Guide for Teams
A practical walkthrough of what goes into a penetration test report, section by section, so founders and engineering teams can read one with confidence and act on what it says.
8 min read
What Is VAPT? Vulnerability Assessment and Penetration Testing Explained
VAPT stands for Vulnerability Assessment and Penetration Testing. Here is what each half means, how they differ, what a VAPT engagement covers, and when you actually need one.
6 min read
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read