Assessments with a defined scope and a usable report
We test only assets you own or are authorized to have tested. Each engagement is priced from its scope, complexity, environments and retest terms.
Web & API Penetration Testing
A scoped assessment of web applications and APIs you own or are authorized to test, led and validated by a human researcher.
Request a scoped proposalDeliverables
- Statement of work and signed rules of engagement
- Methodology and coverage summary
- Reproducible, redacted findings with evidence
- Severity, business impact and remediation guidance
- Executive summary for leadership
- Retest window and final report
Android & iOS App Penetration Testing
Testing of Android and iOS apps you publish or are authorized to test: the app on the device, and the APIs behind it.
Request a scoped proposalIncludes
- Static and dynamic analysis of the APK or IPA
- Local data storage, Keystore and Keychain use, and logging
- Transport security, certificate pinning and API traffic
- Authentication, session handling and deep links
- Root and jailbreak detection and tamper resistance
- The backend APIs the app depends on
Thick Client Penetration Testing
Assessment of installed desktop and client-server applications, from the binary on the user's machine to the servers it talks to.
Request a scoped proposalIncludes
- Windows, macOS and Linux desktop applications
- Traffic interception and server-side testing
- Local files, configuration and hardcoded secrets
- DLL hijacking, insecure updates and privilege escalation paths
- Binary and memory analysis where in scope
Continuous Security Testing
Scheduled reassessments as your application changes, with updated findings, retests and regular review calls.
Request a scoped proposalIncludes
- Agreed testing frequency and asset limits
- Updated findings and risk trend summaries
- Retesting of fixed issues
- Recurring review calls with your engineers
AI & LLM Application Assessments
Available by scoping
For products that use models and agents. We look at prompt injection, sensitive-data exposure, agent permissions and tool misuse, alongside conventional application risks.
Request a scoped proposalIncludes
- Model interfaces and integrations
- Agent tools and permission boundaries
- Sensitive-data handling
- Application-layer vulnerabilities
Not sure which one you need?
Describe your application and what’s driving the assessment. We’ll suggest a scope that fits.