Penetration testing
Web Application Penetration Testing
Your web apps are the front door to your data. We test them hard, find the flaws and show you how to fix them.
Overview
What it is
Web applications are where most organisations are attacked, and where a single flaw can expose customer data or hand an attacker the keys. We test your applications and APIs against the full range of modern web attacks.
Our testing is hands-on and methodology-led, aligned to the OWASP Top 10 and beyond. We find the issues automated scanners miss: broken access control, business logic flaws, injection, authentication weaknesses and more.
Who it is for and what you get
Who it is for
- Teams running customer-facing web apps or portals
- SaaS products that need security assurance for their buyers
- Anyone handling personal or payment data through a web app
- Development teams who want issues caught before release
What you get
- A clear report with an executive summary for leadership and technical detail for your team.
- Every finding ranked by real-world risk, with practical, prioritised remediation advice.
- A free retest of the fixes you make, so you can prove the risk is closed.
- A debrief call to walk through the results and answer your questions.
Our process
How the engagement runs
- 01
Scope
We agree the application, user roles and whether testing is authenticated, unauthenticated or both.
- 02
Test
We work through the application by hand, covering access control, injection, logic flaws and session handling.
- 03
Report
You get each finding with evidence, impact and a clear fix, ordered so you know what to tackle first.
- 04
Retest
We verify your fixes and confirm the issues are closed.
FAQs
Frequently asked questions
Do you test authenticated areas?
Yes. We recommend testing with valid accounts for each user role, so we can find flaws behind the login that an attacker would reach after gaining access.
Can you test our API?
Yes. We test REST, GraphQL and other APIs as a core part of web application testing, including authentication, authorisation and input handling.
Will testing affect our live site?
We prefer to test a staging environment that mirrors production. Where we must test live, we agree safeguards first and avoid destructive actions.
Do you cover the OWASP Top 10?
Yes, and more. The OWASP Top 10 is a baseline. We also test business logic and issues specific to how your application works.
Related services
You might also need
Infrastructure
Internal and external testing of networks, servers and devices.
Learn moreCloud
Test your Microsoft 365, Azure and AWS for misconfiguration and weak controls.
Learn moreWebsite Vulnerability Scanning
Ongoing scanning that flags new weaknesses on your sites as they appear.
Learn moreGet started
Ready to scope your web application penetration testing?
Tell us about your organisation and we will recommend the right approach. Quote only, no hard sell.