A clear view of where your systems are weak
We test your servers and web applications for known weaknesses and misconfigurations. You get one report written for three audiences, and a retest once fixes are in place.
What is included
- Server assessment
- We check operating system versions, exposed services, configuration and patch levels.
- Web application testing
- We test authentication, sessions, access control, input handling and business logic, using the OWASP testing guide.
- Manual verification
- We confirm scanner results by hand and remove false positives before reporting.
- Risk rating
- Each finding is rated by likelihood and impact in the context of your business.
- Three-level report
- The report has a strategic summary for management, a tactical plan for team leads and operational detail for engineers.
- Retest
- We check each fix and update the status of every finding.
How it works
Scope. We agree targets, test windows, accounts and rules of engagement in writing.
What you receiveA signed scope and a test schedule.
Test. We run automated scans, then verify and extend them with manual testing.
What you receiveImmediate notice of any critical finding.
Report. We write up each finding with evidence, impact and remediation steps.
What you receiveThe three-level report and a walkthrough call.
Retest. We recheck the fixed items within an agreed window.
What you receiveA retest report marking each finding as open or closed.
Right for you if
You are about to launch or change a web application.
A client or partner has asked for evidence of security testing.
You have inherited systems and do not know their condition.
Questions
Is this a penetration test?
It is a vulnerability assessment with manual verification. We describe the methods in the scope, so you know exactly what was tested.
Will testing disrupt production?
We agree test windows and avoid destructive tests. Where risk exists, we test on staging.
What is in the management summary?
It covers overall risk, the main themes and recommended priorities, in plain language.
Is the retest included?
One retest within 30 days is included. Further rounds are quoted separately.