Penetration Testing
We test your application and its API by hand, the way a customer can reach them, and prove each issue we find.
Tested by hand
Evidence, not a scanner summary.
Two customer accounts
To check neither can open the other’s records.
Proof for every finding
The request that proves it, and the fix.
Recognised standards
The OWASP testing guide and PTES.
Retest included
We check each fix held.
Why test by hand
The scan passed. The order still opened.
A scanner can’t tell whose order it’s reading. A tester with two accounts can.
#1
risk in the OWASP Top 10:2025 is broken access control, the flaw shown here.
- Access control1.84m
- Cryptography1.67m
- Injection1.40m
Recorded occurrences in OWASP’s contributed data, top three categories
SourceOWASP A01 (opens in a new tab), A04 (opens in a new tab) and A05 (opens in a new tab)
The testing gap
13 in every 100
UK businesses carried out penetration testing in the last 12 months.
Most went the year without one.
SourceDSIT, Cyber Security Breaches Survey 2025/2026 (opens in a new tab)
94%
of UK organisations surveyed had an API security incident in the previous 12 months.
- 94%UK
- 88%France
- 83%Germany
SourceAkamai, API Security Impact Study 2026, EMEA overview (opens in a new tab)
Read the researchHide the research
- #1
risk in the OWASP Top 10:2025 is broken access control, the class of flaw behind one customer opening another’s order.
OWASP, Top 10:2025, Introduction (opens in a new tab)Announced Nov 2025OWASP, Top 10:2025, A01 Broken Access Control (opens in a new tab)Announced Nov 2025OWASP, Top 10:2025, A04 Cryptographic Failures (opens in a new tab)Announced Nov 2025OWASP, Top 10:2025, A05 Injection (opens in a new tab)Announced Nov 2025
- 94%
of UK organisations surveyed had at least one API security incident in the previous 12 months, the highest of the three EMEA markets in Akamai’s 2026 study.
Akamai, API Security Impact Study 2026, EMEA overview (opens in a new tab)Survey, Nov 2025
- 13%
of UK businesses carried out penetration testing to identify cyber risks in the last 12 months.
DSIT, Cyber Security Breaches Survey 2025/2026 (opens in a new tab)2,112 UK businesses, Aug to Dec 2025
How we work
We come in like a customer
Map it, try the way in, test what it trusts, then prove it.
Its pages and API, before signing in.
Sign in, reset and sessions, then two accounts.
Order numbers, inputs, flows and configuration.
OWASPA01:2025Broken Access ControlReproduce it, hand over the evidence, retest the fix.
Where we find an issue, we look for the same gap elsewhere.
- OrdersFound here
- InvoicesSame gap
- ReturnsSame gap
Owner check on all three
Your test
From scoping call to retest
Length depends on scope. We agree it on the scoping call.
Before
Testing
Anything serious, we tell you the same day.
After
Later
Signed in as customer A
shop.example/orders/10442
- During the testCustomer B’s order
200 - At the retestNot found
404
What you get
A report your developers can replay
- The request that proves itRequest and response for every finding.
- Business impact firstIn plain terms.
- The fix at three levelsFix it now, fix the pattern, keep it fixed.
- Fixes in priority orderWhat to do first, and why.
Sample report, fictional client
What we need from you
Almost nothing
Three things to get started, and one more that helps.
Your written go-ahead
A signed authorisation to test.
What to test
Your application and its API.
Two customer accounts
With the same access.
Source code accessOptional
If you can share it.
Nothing to install.
Common questions
Before you book
A scan reports what might be wrong. We show what someone can actually do with it, and prove it.
You choose what we test, and we test it by hand. The assessment starts from your domain and finds what you expose.
We agree the targets, accounts and timing before we start, and what happens if something serious turns up.
Bradley and Aaron. Whoever finds an issue writes it up and answers your developers’ questions.
Priced for your scope. We quote after a short scoping call.