In 2 to 3 weeks we test your whole platform the way an attacker would: your apps, your API, your cloud and your business rules, with every fix verified and the money at stake.
Manual pentest of up to 3 applications or 1 platform, REST or GraphQL API up to ~80 endpoints, up to 4 roles, business logic, tenant isolation and 1 cloud account. Includes everything in Dig. A second Lop reviews every finding.
A free scanner checks whether the door exists. A Lop tests whether it opens: with real accounts, by hand, and chaining small flaws that look like nothing alone and cost a lot together.
Automated scanners detect known signatures. Access control, session logic and vulnerability chains only show up with authenticated manual testing. Every finding is confirmed with a proof of concept and reviewed by a second Lop.
Up to 3Web systemsWeb applications (OWASP WSTG)
Nobody gets into someone else’s account: passwords, password recovery and sessions.
Authentication, account recovery, session management and MFA.
Nobody can slip code or commands in through a form, a search box or a web address.
SQL, NoSQL, command and template injection; reflected, stored and DOM XSS.
Nobody can upload dangerous files disguised as a photo or a PDF.
File upload: type, content, name, path and server-side execution.
Your site cannot be used to trick your visitors or to reach your internal systems.
CSRF, open redirects, SSRF, clickjacking and misconfigured CORS.
Forgotten files and pages: backups, test panels, old versions.
Content discovery: exposed backups, .git and .env, staging environments and unlinked endpoints.
An error on screen does not reveal internal data, keys or code.
Error handling, stack traces, secrets in client-side code and information leaks.
Plugins, themes and site software with known flaws.
Components with known CVEs: CMS, plugins, themes and JavaScript libraries.
Your customers’ data travels protected and is not left exposed in the browser.
Cookies (Secure, HttpOnly, SameSite), security headers, CSP and sensitive data on the client.
Nobody can try thousands of passwords or flood your forms with a bot.
Rate limiting, user enumeration, captcha and anti-automation controls.
4User typesRoles
One user cannot see another user’s orders, invoices or data.
Horizontal access control (IDOR) in views, downloads, exports and internal calls.
A regular user cannot reach admin functions.
Vertical privilege escalation and unprotected admin functions.
What is hidden on screen is also locked behind it.
Authorization enforced on the server, not the browser; tampered parameters and hidden fields.
Servers exposed to the internetExternal surface: ports and services
Everything of yours that is open to the internet, even what nobody remembers.
Subdomain discovery (DNS and certificate logs), ports and services.
Panels, databases or remote access that should not be visible from outside.
Exposed admin services: SSH, RDP, databases, hosting and CMS panels.
Old software with flaws attackers are already using.
Versions with known CVEs, prioritized by real exploitation (KEV and EPSS).
The secure connection, the browser padlock, is set up right.
TLS: protocols, ciphers, certificates and HSTS.
Nobody can take over a subdomain you stopped using.
Subdomain takeover and DNS records pointing to retired services.
Nobody sends mail in your nameSPF, DKIM and DMARC
Nobody sends emails that look like yours to your customers or suppliers.
SPF, DKIM and DMARC: records, policy and alignment.
Your email travels encrypted between servers.
STARTTLS, MTA-STS and TLS-RPT on your mail servers.
Your domain is not on blocklists that send your emails to spam.
Domain and sending IP reputation on blocklists.
Your Microsoft 365 or Google accountsM365 or Workspace configuration (CIS)
Every account has two-factor and no old doors are left without it.
MFA, conditional access and legacy authentication disabled.
Who is an admin, and who should no longer be one.
Privileged accounts, admin roles and inactive accounts.
Your documents are not shared with anyone who has the link.
External sharing and public links in OneDrive, SharePoint or Drive.
Rules that forward your mail outside and apps allowed to read it.
External forwarding, mailbox rules and third-party apps with OAuth grants.
There is a record and an alert if someone gets in where they should not.
Audit logging, alerts and mail filtering, per CIS Benchmark.
Connections between systemsREST and GraphQL APIs (OWASP API Top 10)
Nobody uses the API to see or change another user’s data.
Object and function level authorization (BOLA, BFLA) on every endpoint.
API permits and keys cannot be stolen or reused.
API authentication, token (JWT, OAuth) and key lifetime and revocation.
The API neither returns nor accepts more data than it should.
Excessive data exposure and mass assignment.
Nobody can overload the API or abuse its limits.
Resource consumption and missing usage limits (rate limiting).
Old versions and test environments of the API still left open.
API inventory: deprecated versions and exposed test endpoints.
Business rules: payments, coupons, limitsBusiness logic
Nobody pays less, duplicates a payment or ends up with a balance they should not have.
Tampering with the payment flow, prices and amounts on the client side.
Coupons cannot be stacked and promotion limits cannot be exceeded.
Coupon abuse, stacking and limits on promotions and stock.
Steps in a process cannot be skipped, such as confirming an order without paying.
State and order skips in multi-step processes, race conditions included.
One customer cannot see another’s dataTenant isolation (multi-tenant)
One customer never sees or touches another customer’s data.
Data isolation between tenants in queries, exports and files.
Changing an identifier does not drop you into another company’s account.
Tenant identifier tampering in tokens, routes and parameters.
A shared resource does not leak information between customers.
Leaks through caches, queues and storage shared between tenants.
Your cloudCloud configuration (AWS, GCP, Azure)
No file stores or databases are left open to the internet.
Exposed buckets, databases and services; encryption at rest and in transit (CIS).
Who can do what in your cloud, and who has more permissions than they need.
IAM permissions, over-privileged roles and long-lived keys.
There is a record of what happens and the networks are kept apart.
Logging and trails, security groups and network segmentation in the cloud.
The libraries your software usesDependency review (SCA)
Libraries in your software with known flaws.
Dependencies with known CVEs, prioritized by real exploitation (KEV and EPSS).
Unmaintained or too-old components.
Unsupported dependencies, pinned versions and risky licenses.
We sign what is in scope, the authorization and who your contact is. You give us one test account per user type.
We agree in writing on the scope, the testing authorization, the contact person and 1 test account per role (up to 4).
2
Days 1 to 3
Map of the platform
We list everything of yours visible from the internet, your apps and every entry point of your API.
External surface, application inventory and enumeration of API endpoints. That is the surface we will test.
3
Days 4 to 12
Manual testing
We look for flaws by hand in your apps, your API, your cloud and your business rules. If something is serious, we tell you the same day.
Manual testing of apps, API (OWASP API Top 10), business logic, tenant isolation, cloud (CIS) and dependencies (SCA). Same-day notice for a critical finding.
4
Day 13
Verification
A second Lop reviews every finding to rule out false alarms.
A second analyst reproduces every finding and rules out false positives before reporting it.
5
Days 14 and 15
Report and wrap-up
We hand you the report and hold a 30-minute meeting to go through it.
We deliver the leadership report and the technical report, and close with a 30-minute meeting.
6
Up to 6 months
Retests
You fix it, you tell us and we verify at no cost, as many times as needed.
Unlimited retests of what we found for 6 months, at no charge.
What you get
A short report for leadership: how much money is at stake and what the law in your country says.
Leadership summary with the business impact and the legal framework of the client’s country.
The detail of every flaw, with the full chain when several link together, and how to fix it.
Technical report with every finding, its CVSS severity, the exploitation chains and the remediation steps.
Proof that the audit was done, to show customers or partners.
Attestation with a verifiable signature of the scope and the date.
A dashboard where you see the status of every fix at any time.
Dashboard with the status of every finding: open, in progress or verified.
30 minutes to go through the report and answer questions.
30-minute wrap-up meeting with the technical team.
Everything in Dig: your site, your email and your Microsoft 365 or Google Workspace accounts.Full Dig base: external surface, email (SPF, DKIM, DMARC) and Microsoft 365 or Google Workspace configuration.
Up to 3 web applications or 1 platform.Up to 3 web applications or 1 platform, with full OWASP WSTG.
1 API with up to 80 entry points.1 REST or GraphQL API, up to ~80 endpoints (OWASP API Top 10).
Up to 4 user types.Up to 4 roles, with access control testing across all of them.
Your business rules and, if you are multi-tenant, the separation between customers.Business logic and tenant isolation (multi-tenant).
1 cloud account and the libraries your software uses.1 cloud account (AWS, GCP or Azure) with CIS and dependency review (SCA).
Does not include
Your office network and your internal systems. Those go in Warren.Internal network and Active Directory. Out of scope: that is Warren.
Mobile apps. They are a separate module.Mobile apps (OWASP MASVS). Standalone module.
Tests that could take your service down. We never run them.Denial of service and any destructive test. Out of scope.
The servers of the company that hosts your platform. We test your platform and your configuration, not the provider’s.Third-party infrastructure: managed hosting and SaaS. Only the client’s platform and configuration.
If your platform goes past these limits, we agree on a fixed quote before signing. No surprises.
Questions before you buy
How long does it take and when do we start?
Between 2 and 3 weeks. We start within the week after signing. If it is urgent, write to us and we will see if we can start within 72 hours.
I have an API and several apps. Do they all fit?
Up to 3 applications or 1 platform and 1 API of up to 80 entry points fit. If you have more, we measure it in the diagnosis and agree on a fixed quote before signing.
What if you find something serious halfway through?
We tell you the same day. We do not wait for the report to tell you about a critical problem.
Want to see your platform the way an attacker does?
One audit, 2 to 3 weeks, every fix verified for 6 months. We book the start within the week after signing.
