Expert testing
Web app & API
specialists
Thorough testing of web applications and APIs requires deep knowledge of how applications are written, configured, and integrated, and modern testing standards require access to source code. This is where we specialise.
Precision pen testing
services that fit
Specialist expertise and experience
We have a particular focus and specialisation in web apps and APIs, including e-commerce web stores. From modern apps that leverage frameworks, IaaS, and aPaaS, to very large legacy systems, in any deployment configuration.
Source code supported testing
Modern app testing standards require that testers have access to application and IaC source code, and for good reason. We have extensive experience working across all leading languages and frameworks, and produce superior testing ROI as result.
Web app & mobile standards
Whether testing to a formal standard, or searching for common vulnerabilities to a fixed budget, we have extensive experience with leading testing standards, which facilitate clear assurance levels and a deep knowledge of testing coverage requirements.
Privacy is our business
Almost all our web app & API testing engagements involve access to customer source code, and we have strong policies and practices across the business that give our customers total confidence in the privacy of their closed-source repos.
Web & Mobile Testing Standards
OWASP ASVS and MASVS offer the most comprehensive and widely-recognised standards for testing web & mobile apps & APIs, and we are experts in testing to these standards
ASVS
Application Security
Verification Standard
Originally launched in 2008 through a global community collaboration, the ASVS defines a comprehensive set of security requirements for designing, developing, and testing modern web applications and services.
Following the release of ASVS 4.0 in 2019 and its minor update (v4.0.3) in 2021, the recently released v5.0 represents a significant milestone, modernised to reflect the latest advances in software security.
- Pen testing available from Level 1 “Hybrid” to Level 3
- ASVS Level 2 and 3 certifications also available
MASVS
Mobile Application Security
Verification Standard
The OWASP Mobile Application Security Verification Standard (MASVS) is the industry standard for mobile
application security.
Providing a comprehensive set of security controls used to assess the security of mobile apps across various platforms (Android, iOS), it is currently in v2.1.
- Pen testing available from Level 1 to Level 2
- Nam libero tempore, cum soluta
Service packages
Flexible engagements to suit your testing and budget requirements
INCLUDES
- Expert pen testing for websites, apps, APIs, and eCommerce
- Security assurance when it matters most
- Thorough testing based on globally recognised standards like OWASP ASVS, MASVS, and OSSTMM
- Tailored testing to match your specific requirements
- Certified testers with top industry credentials
- The highest levels of threat detection and assurance
- Ideal for business-critical web applications and systems
- Essential for e-commerce web stores, financial services, and healthcare
INCLUDES
- Testing by the same experienced, certified testers
- Referencing OWASP Top 10 and SANS/CWE Top 25 latest lists
- Suitable for marketing/CMS websites, or when cost is key
- This is what most other pen testers service providers offer
- So, compare us on this service only
INCLUDES
- Testing to a nominated PTaaS budget and testing frequency per year
- We pen test requested features or functionality on agree schedules
- Useful for rapidly evolving web sites, web apps, and APIs
- Can operate as outsourced red teaming in collaboration with your in-house DevSecOps
- Can optionally replace Essentials testing where more frequent mini-tests are considered optimal for the target
INCLUDES
- Plan and specify the parameters of your Bug Bounty programme
- Publish a responsible disclosure policy and framework
- Incentivise a wide range of diverse testers and researchers
- phew’s pen testers triage reports and intermediate with participants
- Providing insulation from false positive reports and beg bounty speculators
- Creating a sufficient structure and service to learn about vulnerabilities rapidly
Types of vulnerabilities
Web app & API common weaknesses
Most vulnerabilities are created in the application's source code and IaC, and we're particularly good at finding those and recommending remediations. Common categories include:
Broken Access Control (BAC)
Insecure Direct Object Reference (IDOR)
SQL Injection (SQLi)
Cross-site Scripting (XSS)
Sensitive Information Disclosure
Frequency of Testing
At least annually
All frameworks and standards that require pen testing expect that testing will be performed at least annually. However, the most appropriate testing frequency depends on various considerations, including:
How business-critical is the target?
How rapidly is the target changing?
What assurance/confidence level is required?
What is the stakeholder risk appetite?
Pen testing budget, with PTaaS, Bug Bounty?
Outputs
We take pride not just in our testing but also in the quality and usefulness of our reporting outputs and engagement
Details
Full depth reporting
Our primary output is an in-depth report covering of all aspects of the in-scope targets, testing standards, discovered vulnerabilities, recommended remediations, and other systems hardening advice
Actionable
Enumerated findings
Each type and instance of vulnerability is enumerated to assist with understanding, planning and tracking remediations, within a testing cycle and between periodic tests over time
Summarised
Stakeholder reporting
We understand that pen test reporting is typically too technical and too sensitive to share with non-technical or external stakeholders, so our engagements include reporting specifically for this purpose
More
Advisory support
We are also available to support remediation as well as secure architecture planning, drawing on our extensive experience across many examples of secure design, implementation, and SSDLC
Evidence
Certifications
Verified expertise
Our testers hold the highest certifications relevant to globally recognised testing standards, and as an organisation we pursue continuous improvement and technical research to remain current with the evolving threat landscape.
Better Penetration Testing
Get clear insights on your current risks, what to fix, and what matters most to keep your business secure, stable, and scalable
