Find the vulnerabilities an attacker would find first
We run manual penetration testing — web, API, mobile, or cloud — against the OWASP Top 10 and your compliance requirements, and hand you evidence-backed findings your engineers can actually reproduce and fix.
- US, Canada & UK overlapWorking hours planned around your team, not just ours.
- One point of contactA named lead owns the engagement end to end — no ticket queue.
- NDA on every engagementSigned before we see a single ticket or line of test data.
- Scale up or down monthlyNo multi-year lock-in — resize the team as the release calendar changes.
Who this is for
What you get
- Manual penetration testing across your web app, API, or mobile app (scope agreed at kickoff) — not just an automated scanner report
- Coverage of the OWASP Top 10, or the OWASP API Security Top 10 for APIs, with each finding manually validated and reproducible
- CVSS-scored findings with proof-of-concept evidence (screenshots, request/response captures) for every vulnerability
- An executive summary report for stakeholders and a technical report with reproduction steps for engineers
- Findings mapped to the compliance framework relevant to your scope (PCI DSS, ISO 27001, SOC 2, HIPAA, GDPR, or Canada's PIPEDA)
- Remediation guidance for every finding, prioritised by severity
- One formal retest after fixes are deployed
Timeline & process
Threat modeling & scoping
Review architecture and data flows, then agree on scope, rules of engagement, and success criteria.
Reconnaissance & testing
Enumerate the attack surface and run manual exploitation attempts against the agreed targets.
Reporting
Deliver the executive summary and technical report with CVSS scores and proof-of-concept evidence.
Remediation support & retest
Guidance session for your developers, followed by a formal retest of fixed findings.
What we need from you
- Written authorization to test the agreed scope, required before any testing begins
- Access to a staging environment, or explicit sign-off to test production within an agreed window
- Test accounts covering each user role or permission level in the application
- Architecture documentation or a walkthrough call so we understand data flows and trust boundaries
Proof, not promises
Not in scope, so there are no surprises
- Ongoing or continuous security monitoring, or a managed SOC — this is a point-in-time assessment
- Physical security testing or social-engineering/phishing campaigns, unless scoped separately
- Testing of production systems without your explicit written authorization
- Implementing the fixes ourselves — we hand over remediation guidance; your team implements it (or we do, as a separate engagement)
- Issuing formal compliance certification (e.g. a PCI DSS attestation) — we provide evidence your auditor or QSA can use, not the certification itself
Questions we get asked
We need this for a SOC 2 or HIPAA audit — will your report satisfy our auditor?
We map every finding to the relevant controls in PCI DSS, ISO 27001, SOC 2, HIPAA, GDPR, or PIPEDA and hand you evidence your auditor or QSA can act on directly. We don't issue the certification itself — that's between you and your auditor — but the report is built to be handed straight to them.
Can you test while our team is online, so we can ask questions during the engagement?
Yes. Testing windows and the remediation guidance session are scheduled to overlap with US and Canadian business hours, and the retest after fixes ship follows the same rule.
How is this different from the automated scanner report we already get from our CI pipeline?
A scanner flags patterns; it doesn't chain them into an actual exploit or tell you which findings are false positives. Every finding in our report has been manually reproduced with proof-of-concept evidence — request/response captures or screenshots — before it reaches you.
Do you need production access to test?
Only with your explicit written authorization. Most engagements test against staging; where production testing is required, we agree the window and blast radius with you before anything starts.
What if we're a Canadian company subject to PIPEDA instead of GDPR?
We scope against PIPEDA's safeguarding requirements the same way we would GDPR or HIPAA — the finding format doesn't change, only which controls each finding gets mapped to.