Security & Vulnerability Assessment

It is an application security assessment based on the OWASP methodology, focused on your web application and APIs. If you need a formal penetration test with a specific certification attached, we will tell you plainly and point you toward it rather than relabelling what we do. The practical difference is scope and framing: this examines your application in depth — authentication, authorisation, input handling, configuration, dependencies — and produces demonstrated findings with remediation guidance. It is not a network-wide or physical-security exercise, and it does not carry a certification body’s stamp. For most teams facing a customer security questionnaire, this is the work that answers it.

We prefer to test in a staging environment that mirrors production, and we agree the rules of engagement in writing before anything starts — scope, timing, what is explicitly out of bounds, and who to contact if something looks wrong. Where production testing is genuinely necessary, we schedule it with you and stay within limits you set. Some checks are intrusive by nature, and those are named in advance rather than discovered afterwards. You will always know what is being tested and when. If a finding turns out to be more serious than the report cadence assumes, we tell you immediately rather than saving it for the write-up.

A written report with findings ranked by severity, each with reproduction steps, evidence and specific remediation guidance — plus a session with your developers to work through the fixes. The report is written to be read by two audiences: your engineers, who need enough detail to reproduce and fix, and a reviewer or customer who needs to see that the work was done and what came of it. Findings are demonstrated rather than inferred from a scanner, and severity reasoning is shown so you can disagree with it. Retesting the fixes and reissuing the report is included, and that reissued version is the one worth sharing externally.