Web Application & External Penetration Testing
Automated scanners find known patterns. Attackers find what the scanner missed: broken access control, flawed business logic, and chains of small issues that add up to a breach. Our penetration tests are performed manually by experienced testers who think like real attackers, and every finding comes with evidence and a clear fix.
Starting at $4,900 for one small web application or up to 10 external IPs, retest included. Final price depends on scope.
What we test
Web applications and APIs
Authentication and session handling, access control between users and roles, injection, business logic, file uploads, and exposure of sensitive data.
External network perimeter
The internet-facing systems attackers see first: VPNs, remote access, email and web servers, exposed services and cloud assets.
Cloud-hosted applications
Applications running on AWS, Azure or Google Cloud, including how they are exposed through CDNs and WAFs.
Exactly what we test is agreed with you in writing before any testing starts.
What you receive
-
An executive summary in plain language, with the overall risk and the issues to fix first.
-
Technical findings with step-by-step evidence, affected assets, severity and specific remediation guidance.
-
A debrief call with your team to walk through the results.
-
A retest letter confirming which findings were fixed.
Who it's for
Companies launching or changing a web application, companies that need a penetration test for a customer security review, cyber insurance or an audit, and teams that want an independent view of what an attacker could do today.
A penetration test can support requirements such as ISO/IEC 27001:2022 control A.8.29 (security testing in development and acceptance).
How we work
01
Scoping: we agree on targets, test windows, accounts and rules of engagement in writing before any testing starts.
02
Testing: manual testing guided by the OWASP Web Security Testing Guide (WSTG) v4.2 and the OWASP Application Security Verification Standard (ASVS) 5.0, with automated tools used only to support the work.
03
Validation: every finding is confirmed and reproduced, so your team does not chase false positives.
04
Reporting: an executive summary for leadership and a technical report with evidence, risk rating and remediation steps for each finding.
05
Retest: after you fix the issues, we retest them and update the report.
FAQ
Is this just a vulnerability scan?
No. Scanners are one input; the findings that matter most — access control and business logic flaws — are found by people.
Will testing disrupt production?
We agree on test windows and rules of engagement in advance, avoid destructive techniques unless approved, and can test a staging environment that mirrors production.
Do you need credentials?
For web applications, yes: we test with accounts for each role so we can check what one user can see or do as another.