Penetration testing for web applications and APIs
AI-assisted discovery, manual verification of every finding, and a report your engineers can act on without a meeting.
- Web applications
- REST and GraphQL APIs
- Authentication and SSO
- Admin and internal tools
What it is
A penetration test is an authorized attempt to break into your application the way a real attacker would, within an agreed scope and time window. We combine automated and AI-assisted discovery to cover ground quickly with manual testing to find the issues scanners miss: broken authorization, business logic abuse and chained weaknesses.
Every finding is reproduced by a person before it goes in the report. You get no false positives and a clear proof-of-concept for each issue.
What we check
- Authentication and session management: credential handling, password reset, multi-factor flows, token lifetime and session fixation.
- Authorization: horizontal and vertical privilege escalation, insecure direct object references and tenant isolation.
- Injection and input handling: SQL, NoSQL, command and template injection, cross-site scripting and request smuggling.
- API security: rate limiting, mass assignment, excessive data exposure, broken object-level authorization and undocumented endpoints.
- Business logic: payment and pricing manipulation, workflow bypasses, race conditions and abuse of limits or trials.
- Configuration: security headers, CORS, TLS, error handling, dependency vulnerabilities and exposed debug or admin surfaces.
What you receive
- A technical report: every finding with CVSS-based severity, reproduction steps, evidence (requests, responses, screenshots) and remediation guidance.
- An executive summary: overall risk, the themes behind the findings and what to fix first.
- A re-test of fixed findings within the engagement window, and an updated report showing what is closed.
- A letter of attestation summarising scope, dates and outcome, suitable for customers and due diligence.
Typical timeline
2 to 3 weeks
For one application and its APIs, including one re-test. Larger estates are scoped per application.
Pricing
Quoted for your app
Discussed on a short call, then a fixed price in writing before anything starts. Request a quote
Who it's for
- SaaS teams asked for a pen test report by an enterprise customer or during a security questionnaire.
- Products handling payments, personal data or multi-tenant data.
- Teams shipping a major release or opening an API to partners.
Next step
Tell us about the app. We discuss scope and price on a short call, then send a fixed quote in writing.
We only test applications you own or are explicitly authorized to test.
How quoting works
Tell us about the app
Platform, roughly how big it is and what you are worried about. Two minutes on the form.
Scoping call
A short call with an engineer to agree what is in scope, what is out, and when. Pricing is discussed here.
Written proposal
A fixed price, timeline, deliverables and rules of engagement in writing. You sign, we schedule.
Common questions
What is the difference between VAPT and a vulnerability scan?
A scan lists possible issues automatically. VAPT adds manual testing: a person tries to exploit what the tools find, looks for logic and authorization flaws scanners miss, and confirms every finding with evidence before it reaches you.
Will testing break our production app?
We agree the environment, accounts and time window first, avoid destructive tests and denial of service, and stop immediately if something looks fragile. Many teams give us a staging copy; we can test production too when that is what's in scope.
Do we get something we can show customers?
Yes. Besides the technical report and executive summary, you get a letter of attestation after the re-test that summarises scope, dates and outcome.
Further reading
Often paired with
- AI Reverse-Engineering Exposure AuditWe point AI-assisted reverse engineering tools at your shipped app and report what they recover: logic, endpoints, secrets, data shapes and how much of the product could be rebuilt.
- Mobile App Security TestingStatic and dynamic security testing of Android and iOS apps, per platform: reverse engineering of the build, local data storage, network security, authentication and the backend it talks to.
Next step
Find out what your app gives away. Book a free exposure call.
Thirty minutes with an engineer, not a sales deck. Tell us what you ship; we tell you what we'd look at first and what an audit would involve.
We only test applications you own or are explicitly authorized to test.