Board summary
Two pages, risk-ranked, no jargon.
Penetration testing.
Manual, certified, and reproducible. We test web apps, APIs, mobile apps, internal networks and cloud tenants the way real attackers would, then help you close every finding.
Scope
What we can test.
- Web applications and single-page apps (OWASP Top 10 + business logic)
- REST, GraphQL and gRPC APIs, including auth flows and rate limits
- iOS and Android apps, with jailbreak and runtime instrumentation
- Internal and external networks, Active Directory and Entra ID
- AWS, Azure and GCP tenants, Kubernetes clusters and CI/CD
Methodology
Aligned with OWASP, PTES and NIST 800-115.
Recon
Passive and active discovery of hosts, endpoints, roles and data flows.
Exploit
Manual exploitation and chaining of weaknesses to prove real impact.
Escalate
Privilege escalation and lateral movement, within agreed limits.
Report
CVSS 4.0 scored findings, proof of concept and remediation guidance.
## HIGH · CVSS 8.1 · Broken object level authorisation
affected: GET /api/v2/invoices/{id}
Any authenticated user can read invoices belonging to other
tenants by incrementing the numeric id.
$ curl -H "Authorization: Bearer $USER_A" \
https://api.example.com/api/v2/invoices/10442
200 OK {"tenant":"org_B","total":"€18,240.00"}
fix: enforce tenant_id from token in InvoiceRepository.find()
status: retested 2026-09-18, RESOLVED
Deliverables
Reports your developers will read.
Each finding is written as a ticket: what, where, how to reproduce, and the smallest change that fixes it.
Findings pack
Markdown and Jira export with PoCs.
Closure letter
Attestation for customers and auditors.
Live walkthrough
90 minutes with the testers themselves.
Questions
Pentest FAQ.
How much notice do you need?
Usually two weeks. For urgent pre-launch or investor-driven tests we can often start within five working days.
Do you test from inside our network?
Yes, via a small Linux appliance or VM we ship to you, or over a site-to-site VPN. No permanent agents are left behind.
Is the retest really free?
One retest of all reported findings within 60 days of the report is included in every pentest quote.
Can you sign our NDA and MSA?
Of course. We also carry €10M professional indemnity and cyber liability insurance.
Free · 3 minutes · no agent install
Find out what attackers already see.
Run our external threat check on your domain. We look at exposed services, leaked credentials, email spoofing and TLS hygiene, then send a plain-English report.