Penetration testing

Penetration testing and compliance work for web apps, APIs, networks and the people who run them.

What non-compliance costs

Regulators have fined companies billions for failing to protect data. These four are public record.

€1.2B
Meta, GDPR, 2023
For transferring EU users’ data to the US in breach of GDPR transfer rules, the largest GDPR fine to date.
€746M
Amazon, GDPR, 2021
Fined by Luxembourg’s data protection authority over how it used personal data for advertising.
$700M
Equifax, 2019
Settlement after a breach exposed the personal data of 147 million people.
$131M
Anthem, HIPAA
$16 million to regulators plus $115 million in settlements after a breach affecting 79 million people.

Every finding comes with its fix, and we retest once you have patched.

HighFinding UII-07
Any signed-in user can read other customers’ invoices
GET /api/invoices/:id · broken object-level authorization · fixed and retested
Web application testing
Your app attacked the way a real intruder would, covering the OWASP Top 10 and the business-logic flaws scanners miss.
SQL injection · cross-site scripting · authentication bypass · session handling · business logic · APIs
Strict-Transport-Security Present
Content-Security-Policy Missing
X-Content-Type-Options Present
Referrer-Policy Present
Network testing
Your infrastructure from outside and inside: what is exposed, what is misconfigured and how far an attacker could get.
External and internal networks · wireless · firewall rules · segmentation · VPN
Mobile app testing
iOS and Android apps taken apart and run under observation, from the code to the traffic they send.
Static analysis · runtime testing · API security · data storage · transport security · authentication
Social engineering
The people side: would your team click, plug in or let someone in?
Phishing campaigns · physical access · USB drops · phone pretexting · awareness training

Standards we work to: PCI DSS, HIPAA, SOX, GDPR, ISO 27001 and NIST.

GDPR
Data protection and privacy for anyone handling EU residents’ data. Fines reach €20 million or 4% of annual revenue.
Impact assessments · privacy policies · consent · breach response · right to erasure · cross-border transfers
HIPAA
Protecting patient data, where penalties reach $1.5 million per violation category per year.
Risk analysis · Security and Privacy Rules · breach notification · business associate agreements · training
PCI DSS
Card payments, where non-compliance costs $5,000 to $100,000 a month in fines.
Network assessment · cardholder data · vulnerability management · access control · monitoring · incident response
SOX and ISO 27001
Financial controls and information security management for larger organisations.
Internal controls · ISMS · audit trails · risk framework · policies and procedures · continuous monitoring

Reconnaissance. We gather what an attacker could learn about you and map everything that can be reached.

Scanning. Automated tools and manual work find the weak points.

Exploitation. We try to break in through them, carefully, without harming live data or service.

Reporting. A written report of every finding, how serious it is and exactly how to fix it, followed by a retest.

Assessments start at $3,000 and full penetration tests at $6,000. Price your project

Apps we built and secured are running today. Browse the work

New York City area · replies within 24 hours