Application auditing, QA and pentesting
We review your applications as an attacker would and as a demanding user would. We find vulnerabilities, bugs and bottlenecks, and tell you how to fix them in order of priority.
What the service includes
Application pentesting
Penetration testing of web applications, APIs and mobile apps to find vulnerabilities before anyone else does.
Code and architecture audit
A review of the code, architecture and dependencies: quality, maintainability, technical debt and risks.
QA and functional testing
We check that the application does what it should across all its flows, devices and browsers.
Automated testing
Test suites that run with every change and stop what used to work from breaking.
Performance and load
We measure how the application responds with many simultaneous users and where it gets stuck.
Secure maintenance
We update versions, libraries and vulnerable components so an application that works stays up to date.
Step by step, no surprises
-
01
Scope and authorisation
We agree in writing what is tested, how and when. Nothing is touched without authorisation.
-
02
Analysis
We study the application, its architecture and its attack surface.
-
03
Testing
Manual and automated testing, following recognised methodologies such as OWASP’s.
-
04
Report
Findings by severity, with evidence and how to fix them, plus a summary for management.
-
05
Remediation
We help you fix the issues, or fix them ourselves if you prefer.
-
06
Verification
We test again to confirm every vulnerability has been closed.
Technologies and tools
- METHODOLOGY
- OWASP Manual testing Automated testing
- SCOPE
- Web applications APIs Mobile apps
- QUALITY
- Static analysis Performance Dependencies
What we are often asked
What is the difference between an audit and a pentest?
An audit reviews the application from the inside: code, architecture, dependencies and configuration. A pentest attacks it from the outside, as someone without access would, to check which vulnerabilities can really be exploited. They complement each other and are often done together.
Can a pentest affect my application in production?
We agree the scope, techniques and time window beforehand. Whenever possible we work on a test environment identical to the live one; if production has to be tested, we avoid tests that could degrade the service.
What do I receive at the end?
A report with each finding, its severity, the evidence and how to fix it, plus an executive summary for management. Afterwards, if you wish, we check that the fixes work.
Do you audit applications you did not develop?
Yes, and that is the most common case. It does not matter who built it or with which technology: we audit web applications, APIs and mobile apps.
How often should a security audit be carried out?
At the very least, before launching anything important and after major changes. If the application handles sensitive data, it should be reviewed regularly: new vulnerabilities appear in libraries that were safe yesterday.
Related articles
Shall we look at it together?
Tell us what you need and we will reply within 24 working hours.