Web application pentesting

Test the journeys your business depends on.

Specialist delivery and availability are confirmed during scoping.

THE RIGHT STARTING POINT

For portals, SaaS products, commerce journeys, and internal applications before release or after significant change. Mobile clients and separately deployed APIs can be added to scope.

A clear scope. A useful outcome.

Start with your users, roles, sensitive transactions, and tenant boundaries. Combine targeted manual testing with appropriate tooling to examine what a user can do beyond their intended access. Give developers evidence they can reproduce and a clear explanation of the affected business journey.

The final scope, deliverables, and timing are agreed for your engagement.

What we cover

• Login, account recovery, and session handling
• Role, object, and tenant authorization boundaries
• Input handling, uploads, and server-side interactions
• Business workflows and configuration weaknesses

What you take away

• Application scope, roles, and test coverage record
• Validated findings with impact and reproduction steps
• Prioritized remediation guidance for engineering owners
• Agreed retest report and residual-risk notes

How to engage

Fixed application scope with agreed access, test windows, and retest rounds.

What progress looks like

Critical user journeys assessed and significant findings closed with retest evidence.

Before the engagement.

Agree the systems and business processes in scope, the authorisation required, the people involved and how the findings will be used. Timelines, deliverables, exclusions and any verification work should be confirmed directly.