Penetration testing and security audits

Written authorisation from someone empowered to grant it, an agreed scope naming the in-scope systems, and a testing window. If your application is hosted by a third party, their terms may require notification as well. Testing systems without documented authorisation is illegal in India, the UAE and Canada alike, so we do not begin without it.

A scan runs automated checks against known signatures and produces a long list, much of which will not apply to you. A penetration test uses those results as a starting point and adds manual work — chaining issues together, probing business logic and authorisation boundaries. Scanners essentially never find broken access control between two legitimate user accounts, which is among the most commonly exploited weaknesses.

We prefer testing a staging environment that mirrors production. Where production testing is necessary, we agree rate limits and a testing window in advance, and exclude destructive techniques by default. Denial-of-service testing is never included unless it is separately and explicitly requested.

A single web application typically takes one to two weeks including reporting. Larger scopes covering several applications, APIs and cloud infrastructure take longer. Retesting after you have applied fixes usually adds a few days.

We can carry out a gap assessment against the controls you are being asked to satisfy and give you a prioritised plan. Note that we assess and advise — formal certification has to be issued by an accredited auditor, and we will point you to one rather than imply we can certify you ourselves.