Penetration testing
Penetration testing and security assessment
An automated scan prints four hundred findings and tells you nothing about which one loses you the company. We test by hand, as each user role, looking for the flaws a scanner structurally cannot find: one tenant reaching another tenant records, an approval step that can be skipped, an identifier that can be incremented. Then we rank what we find by what it would actually cost you.
Findings ranked by what an attacker could actually reach
Web application and API testing
Authentication and session handling, broken access control, injection, insecure direct object references, and the business-logic flaws that only surface when the tester understands what the application is for.
Infrastructure and configuration
Exposed services, transport security, patch levels, default credentials, permissive storage and cloud configuration - the unglamorous findings behind most real compromises.
Authenticated, role-aware testing
We test as every role, not only as an anonymous visitor. The most damaging breaches come from a legitimate account reaching records it was never meant to see.
Remediation and retest
Every finding carries the steps to reproduce it and guidance written for the developer who has to fix it. Once fixed, we test it again - a fix is not a fix until it has been verified.
You probably need this if…
- A client, insurer or funder is asking for evidence of security testing
- You process personal information and POPIA obligations apply
- The application has run for years and has never once been tested
- You have a scanner report and cannot tell which findings are real
What you get
- Scope and rules of engagement agreed in writing first
- Findings ranked by exploitability and business impact
- Reproduction steps for every finding
- Remediation guidance written for developers
- A retest of fixed findings and a written closing summary
Everything we produce is yours, including the discovery document - whether or not the build goes ahead.
Penetration testing: common questions
Will testing take our production system down?
No. Scope, timing and any excluded tests are agreed in writing before we start, destructive checks run against staging rather than production, and we keep an open channel throughout so anything unexpected stops immediately.
What do we actually receive at the end?
A report giving every finding, its severity, how to reproduce it and how to fix it, plus a walkthrough session and a retest once remediation is done. It is yours to hand to a client, an auditor, or whichever developer maintains the system.
Penetration testing: tell us what you need
Send a short description of the problem. You will get a straight answer on whether this is the right fit and what it would take.
A reply from a developer. Not a sales pipeline. The person who reads your message is the person who would do the work.
An honest answer on fit. If an off-the-shelf product solves your problem better than a custom build, we will tell you which one.
No obligation. A first conversation costs nothing and commits you to nothing. Discovery output is yours either way.