PT/02 · Penetration testing
Your app, tested by someone trying to break it.
Hands-on testing of the web applications and portals your customers rely on. Automated scanners find the obvious problems. Experienced testers find the ones that matter.
01Overview
What we look at.
We look at your application the way a determined outsider would, and the way a curious customer would. The question is simple: can someone see data, take actions or skip steps they shouldn't?
Every finding in the report has been confirmed by hand, explained in plain language and paired with a fix your developers can act on.
In scope
- Sign-in, accounts and password recovery
- Whether one customer can reach another customer's data
- Payments, approvals and other business workflows
- The APIs and integrations behind the app
02Why test
What you get out of it.
Find what scanners miss
The most serious flaws depend on what your app is for. Finding them takes a person who understands the business, not just the code.
Answer customer questionnaires
Larger customers ask for a recent independent test. Our attestation letter answers that without sharing sensitive details.
Meet compliance requirements
Payment card standards, SOC 2 auditors and cyber insurers commonly expect regular penetration testing.
Fix with confidence
Clear guidance for every finding, and a retest to confirm each one is closed.
Ground rules
- Nothing destructive without your written request
- Production testing only in windows you agree to
- If anything looks unstable, we stop and call you
03Included
Every engagement includes.
See a sample reportA clear, written report
A summary for leadership, then each finding with evidence, a severity rating and a fix your team can act on.
Critical findings, same day
If we find something critical, we call you that day instead of waiting for the report.
Retest included
Once fixes are in, we retest at no extra cost and update the report with what's closed.
Attestation letter
A one-page summary of scope, dates and outcome for customers, auditors and insurers.
Readout call
We walk your team through the results and agree what to fix first.
Your data, handled carefully
Test evidence stays encrypted and is deleted after the retest unless you ask us to keep it.
04FAQ
Common questions.
How long does a web application test take?
Most take one to three weeks of testing, depending on the size of the application. The report follows within a week of testing ending.
What does a web application test cost?
Every test gets a fixed quote after a free scoping call, based on what's actually in scope. No hourly billing and no surprises on the invoice.
Do you need our source code?
No. We test from the outside with accounts you provide. If you can share code, it helps us focus, and usually means more value from the same time.
Will you test production?
We prefer a staging environment that mirrors production. If production is the only option, we agree testing windows and stop at the first sign of trouble.
What do you need from us?
A few test accounts and a technical contact. We'll cover the details on the scoping call so nothing slows the test down.
Other testing
PT/01
Network & Microsoft 365 testing
What an attacker can reach from the internet, how far they could get once inside, and how well your accounts hold up.
PT/03
Social engineering
Realistic phishing, phone and text campaigns that show how your team responds, followed by training aimed at what worked.
PT/04
AI system testing
The chatbots, copilots and AI assistants you've deployed, tested for what they could be talked into revealing or doing.
Next step
Scope your test.
You'll speak with the person who does the testing. We reply within one business day.