Description
01 / Overview
What this service delivers
Automated scanners catch the easy issues and overlook the expensive ones, like an endpoint that reveals another customer’s invoices once an ID in the URL is changed. Our testing is manual, covering the common classes of web application vulnerability as well as your specific business logic, and approaches the product as an attacker holding a legitimate login. Each issue comes with steps to reproduce it and supporting evidence, so your developers can fix it rather than debate whether it is real.
02 / Deliverables
What you receive 7 items
- 01Manual testing of login, permissions and business logic
- 02Coverage of common web vulnerability classes plus API-focused tests
- 03CVSS scores for each issue, with reproduction steps and evidence
- 04Access controls tested for every role in your product
- 05An executive summary for non-technical readers
- 06Fix guidance specific to your systems rather than generic advice
- 07A free retest within 30 days and a summary letter you can share with customers
03 / Fit
Who it suits, and what we need from you
Ideal for
- Products that store payment, health or personal information
- Businesses asked for a penetration test report by an enterprise customer
- Teams that have never had an independent security review
What we need from you
- Test accounts for each role, on staging or a near-production setup
- Written permission to test from someone with the authority to give it
- A developer who can respond promptly if we find a critical issue
You share these through the technical brief in your dashboard after checkout.
04 / Outcomes
What changes for your team
- 01
Vulnerabilities found and fixed before attackers find them
- 02
A report you can share with customers or auditors
- 03
Fixes verified by retest, not assumed
This is a remote engineering service, so nothing is shipped physically. Work is delivered into systems you control. Read delivery & handover and refunds & cancellation for the full terms.
Reviews
There are no reviews yet.