Web Application VA/PT
Identifies and exploits vulnerabilities in web applications, combining automated scanning with manual exploitation of confirmed findings.
What this achieves.
Vulnerability identification
Finds and prioritizes security vulnerabilities, including software bugs, misconfigurations, and design flaws.
Impact assessment
Determines the potential impact of each vulnerability on the application and its users.
Security measure validation
Validates existing security measures and their effectiveness at preventing unauthorized access.
Awareness building
Raises awareness among developers and stakeholders of the need for ongoing security testing.
Five phases.
Planning & Preparation
Establish scope, objectives, testing methodology, tools, and resources.
Reconnaissance
Gather information on the target application's structure, functionality, and technology.
Vulnerability Assessment
Run automated and manual scans to identify potential vulnerabilities.
Penetration Testing
Attempt to exploit the vulnerabilities identified in the previous phase.
Reporting & Remediation
Document findings and provide actionable remediation guidance.
What you receive.
Executive Summary
A high-level overview of the results: the vulnerabilities found, their impact and severity, and a risk rating.
Detailed Report
Detailed information on every vulnerability found, including its description and the evidence of its existence.
Vulnerability Evidence
Screenshots, log files, and other evidence demonstrating that each vulnerability exists and what it exposes.
Recommendations
Actionable fixes for the vulnerabilities found, and for the security posture of the web application overall.
Knowledge Transfer
A presentation and discussion with your team covering the findings, the severe vulnerabilities, and remediation.
Where this connects.
Software Source Code Review
Finds issues in the source. This service confirms which of them are exploitable in the running application.
Mobile Application Penetration Testing
The same discipline applied to mobile applications and their underlying infrastructure.
Web Application Assessment
The platform that keeps scanning between engagements, with remediation guidance built in.
Common questions.
What does the assessment look for?
Software bugs, misconfigurations, and design flaws, identified and prioritized, with the potential impact of each on the application and its users assessed rather than just listed.
Automated scanning or manual testing?
Both. Automated and manual scans identify potential vulnerabilities during the assessment phase, then the penetration testing phase attempts to exploit what was found.
Do you check whether our existing controls work?
Yes. Validating existing security measures, and how effective they are at preventing unauthorized access, is one of the stated objectives.
What do we receive?
An executive summary, a detailed report, vulnerability evidence, recommendations, and knowledge transfer, with actionable remediation guidance for each finding.