Services · Security testing
Security testing and threat analysis for web, mobile, cloud and AI
Sample reportDownload security assessment ↗Anonymised sample report. Findings are illustrative; client details are redacted.
01
What is security testing?
Security testing means checking your software and infrastructure for weaknesses before someone else finds them. In practice we:
- Map what you have. We list your apps, APIs, cloud accounts, third-party services, and where your data goes.
- Work out what could go wrong. We find the likely ways an attacker could get in, misuse a feature, or reach data they shouldn't. This is threat modelling.
- Try it, safely. Testers attempt those attacks against agreed environments, within agreed hours and limits. For example: logging in as one user and reading another user's data, pulling keys out of a mobile app, or tricking an AI assistant into revealing information.
- Write it down. We record every issue with evidence, rate how serious it is, and explain how to fix it.
- Check the fixes. After your team makes changes, we retest and update the report.
The result is a clear list of what to fix first. Automated scanners can't give you that, because many serious issues come from business logic and access control. A person has to find those.
02
What we test
Web applications
We test login and session handling, access control between users and roles, input handling, file uploads, payment and refund logic, and admin functions. Testing follows the OWASP Top 10 and ASVS.
Mobile apps (Android and iOS, including Flutter and React Native)
We look at data stored on the device, keys and secrets built into the app bundle, certificate pinning, root and jailbreak handling, deep links and WebViews, and the APIs the app calls. Testing follows OWASP MASVS and MASTG.
APIs
For every endpoint we check whether one user can reach another user's data, test role checks and mass assignment, and look at token handling and rate limits. Testing follows the OWASP API Security Top 10.
Cloud credentials and configuration (AWS, Google Cloud, Azure)
- Leaked secrets: we scan your full git history, CI logs, container images, mobile bundles and public repositories for leaked keys and tokens, and we confirm which ones still work.
- Configuration: we review IAM permissions, public storage buckets, network rules, logging and threat detection.
- Benchmarks: we compare the setup against the CIS Benchmarks for your cloud provider.
AI and LLM features
- Data flow: we trace what data your app sends to the model provider, what ends up in prompts and logs, and how long it is kept.
- Attacks: we test prompt injection (direct, and hidden in documents or web pages), system prompt leakage, and whether AI tools can act beyond the user's own permissions.
- Guidance: testing follows the OWASP Top 10 for LLM Applications.
Threat modelling
Together with your engineers, we draw a data-flow diagram of your system, mark the trust boundaries, and list threats using STRIDE. That list decides what we test, and we report against it.
03
Standards we work to
Our testing methods and reports are aligned with these public standards:
- OWASP Top 10 (2021) for web applications
- OWASP Application Security Verification Standard (ASVS) 4.0.3
- OWASP API Security Top 10 (2023)
- OWASP Mobile Application Security Verification Standard (MASVS) and Testing Guide (MASTG)
- OWASP Top 10 for LLM Applications (2025)
- CIS Benchmarks for AWS, Google Cloud and Azure
- CVSS v3.1 for rating severity, and CWE for classifying issues
We map every finding to the relevant standard. That makes the report useful for your own compliance work, such as ISO 27001, SOC 2 or customer security questionnaires.
04
How it works
- Scoping call (30 minutes). We go through your apps, environments and timelines, and agree what is in scope.
- Fixed-price proposal and rules of engagement. We confirm scope, testing hours, environments, test accounts, who to contact in an emergency, and how data will be handled.
- Threat model. We run a short workshop with your engineers to map data flows and agree priority risks.
- Testing. We test manually, supported by tools. If we find a critical issue, we tell you the same day rather than waiting for the report.
- Report and walkthrough. You get a full report and a call with your team to go through the findings.
- Retest. We verify your fixes and issue an updated report showing the status of each finding.
05
What you receive
- An executive summary for leadership, covering overall risk and what to fix first.
- A findings register listing each issue's ID, severity, CVSS score, affected asset, owner and status.
- Detailed findings. Each one comes with evidence (requests, responses, screenshots), the impact, step-by-step fixes and references.
- A threat model, with the data-flow diagram and the STRIDE threat list.
- Cloud and secrets review results, including how your setup compares with the CIS Benchmarks.
- An AI data exposure review, showing what data reaches the model provider and how to reduce it.
- A standards mapping table, linking each finding to OWASP, MASVS, the LLM Top 10, CIS and CWE.
- Retest results and an updated report.
06
Packages
All work is sold as fixed-price packages based on the agreed scope, such as web and API, mobile, cloud review, AI feature review, or a combined assessment. Each package includes one retest. You'll receive a written proposal after the scoping call.
07
Ready to scope your assessment?
Book a 30-minute call. We'll go through your systems and propose a fixed-price scope.
FAQ
Questions
Will testing affect our live systems?
We agree environments and limits before we start. Testing that changes data or puts load on your systems happens in staging. On production we usually limit ourselves to read-only checks at agreed times, and you get a named contact who can stop testing at any point.
Do you need our source code?
No, but it helps. With read-only access to the code (grey-box testing), we can cover more ground in the same time, and we need it for the git history scan. We can also test without code access (black-box).
How long does an assessment take?
A single web app and its API typically takes one to two weeks of testing. A combined assessment of web, mobile, cloud and AI features usually takes three to five weeks, plus a retest window.
How do you handle our data and credentials?
- **Access:** we use dedicated test accounts and read-only cloud roles. - **Leaked keys:** we never use a leaked key for anything beyond confirming that it is still active. - **Evidence:** it is redacted before it goes into the report. - **Deletion:** we delete working files once the engagement is over.
Can you test our AI assistant if it uses a third-party model?
Yes. We test your integration: what data you send to the model, how it is logged, what the assistant's tools can do, and how it responds to injected instructions. We don't test the model provider's own infrastructure.
Do you provide a certificate or compliance attestation?
We provide a detailed report and retest letter that your auditors and customers can review. We are not a certification body and do not issue compliance certificates. Our reports are aligned with the standards listed above.
Start a project
Have a product to ship?
Engagements are fixed-price packages, shaped to the business. Book a call for a quote.
Book a 30-min call ↗