Services
Security testing and review for applications, APIs, and code
Focused services for teams that build and run software — each scoped to your environment, with validated findings and practical remediation guidance.
Our services
Web Application Penetration Testing
Manual, scope-driven testing of your web application — authentication, authorization, session handling, input handling, and business logic, as agreed for the engagement.
You receive: A written report of validated findings, rated by risk, with reproduction steps and practical remediation guidance.
Learn moreAPI Security Testing
Testing of REST and similar APIs for broken object- and function-level authorization, excessive data exposure, input validation, and abuse scenarios within the agreed scope.
You receive: Endpoint-level findings with request/response evidence and fixes your developers can act on.
Learn moreVulnerability Assessment
Identification and validation of known vulnerabilities and misconfigurations across agreed in-scope assets, with false positives filtered out.
You receive: A prioritised list of confirmed weaknesses with severity, affected assets, and remediation recommendations.
Learn moreSecure Development & Code Review
Security-focused review of application source code — input handling, output encoding, authentication and authorization logic, secret handling, dependencies, and security-relevant configuration.
You receive: Code-level findings referencing the affected files, with remediation guidance that fits your stack.
Learn more- For teams
Security Training & CTFs for Teams
Practical security workshops, hands-on labs, and authorised capture-the-flag exercises for development and technical teams.
You receive: Sessions shaped around agreed learning objectives, using safe, purpose-built lab environments.
Learn more
Which service do you need?
The services answer different questions. If you're not sure, describe your situation when you get in touch and we'll recommend an appropriate scope — including when a smaller engagement is enough.
Vulnerability Assessment
- Answers
- What known weaknesses are present across our assets?
- Breadth & depth
- Broad — many assets, known issues
- Method
- Identification and validation of known vulnerabilities and misconfigurations
- Best when
- You need a prioritised baseline or regular check-up
Web App Penetration Testing
- Answers
- Can someone break into or misuse this application?
- Breadth & depth
- Deep — one application, including logic flaws
- Method
- Manual testing of authentication, access control, input handling, and logic
- Best when
- Before launch, a major release, or a customer security review
API Security Testing
- Answers
- Does our API enforce authorization on every request?
- Breadth & depth
- Deep — endpoints, objects, and roles
- Method
- Manual testing of object/function-level access, data exposure, and abuse
- Best when
- Your API is used by mobile apps, partners, or customers
Secure Code Review
- Answers
- Where in our code do security flaws originate?
- Breadth & depth
- Deep — source code of agreed components
- Method
- Manual review of security-critical code paths, supported by tooling
- Best when
- Building sensitive features or fixing root causes after a test
Training and CTF exercises for teams are covered on the security training page.
Engagement process
From first conversation to verified fixes
A simple, predictable process. Actual timing and deliverables depend on the scope we agree.
Swipe to see all 6 steps
Planning a security assessment?
Tell us about your application, API, or software security requirements. We can discuss the appropriate scope and next steps.
What happens next
- 01We review your enquiry and reply by email
- 02An initial discussion about your application and goals
- 03A written scope — nothing is tested until it's agreed