Application security assessment
One application, checked against a set list in a fixed time. Automated scanning and hands-on testing, a ranked report your engineers can act on, and a re-test once the fixes are in.
Code, dependencies and the running application
Code and dependency scanning
Static analysis (SAST) of your code and a scan of the libraries it depends on (SCA), with false positives removed before they reach your team.
Dynamic testing on staging
Automated testing (DAST) of the running application in your staging or test environment.
Standards-based testing
Web applications against the OWASP Top 10, APIs against the OWASP API Security Top 10, and mobile apps against OWASP MASVS.
Authentication and sessions
Login, password reset, multi-factor, session handling and what each user role can reach.
Scope, test, report, re-test
Scope and authorisation
We agree what is in scope, the test environment, the testing windows and the rules of engagement, and you authorise the test in writing.
Test
Scanning and hands-on testing against the agreed scope, with a named contact on your side throughout.
Report
Findings ranked by risk to your business, each with the evidence and a clear fix, walked through with your engineers.
Re-test
Once your team has fixed the findings, we re-test them once and update the report with the results.
What you get
- A ranked vulnerability report, with the evidence and a fix for each finding
- A short summary written for non-technical readers
- A walkthrough of the findings with your engineers
- Re-test results for the fixed findings
Not included
- Infrastructure and network penetration testing
- Social engineering and phishing (see phishing & account abuse)
- Red-team exercises
- Fixing the findings, unless agreed as a separate engagement
Duration
Agreed at scoping, based on the size of the application and what is in scope.
Price
On request. Fixed and agreed in writing before the test starts.
Is this the right fit?
Teams shipping their own web, API or mobile code without a dedicated security engineer, companies preparing for a customer security review, and anyone who wants a clear first read before committing to ongoing application security work.
Common questions about the assessment
How long does the assessment take?
It depends on the size of the application and how many parts are in scope, such as a web app, an API and a mobile app. We agree the duration and the testing windows at scoping, before any work starts.
What do you need from us?
Written authorisation for the agreed scope, access to a staging or test environment, test accounts for each user role, and someone on your team we can reach during testing. Source code access is needed for the code scanning part.
Will testing affect our live system?
We test against staging or a test environment wherever we can. If something has to be tested in production, we agree the windows, the rate limits and the stop conditions with you first, and we avoid anything destructive.
Is the re-test included?
Yes. Once your team has fixed the findings, we re-test them once to confirm each fix worked, and the report is updated with the results.
What if you find something serious during the test?
We agree up front how a serious finding will be reported. If we find one, we tell your named contact straight away rather than waiting for the final report.
Start with what you are shipping
Tell us what you build and how it reaches users. We’ll suggest what to automate, what is worth a manual test, and what can wait — and if your setup is already in good shape, we’ll say that.