Overview
Most US buyers commission a web application test for one of three reasons: a SOC 2 audit window, an enterprise customer's security review, or a release that changes how money or data moves. We scope around that reason. Testing windows are set against your US time zone, and the final report names the dates, roles tested and method so an auditor or procurement team can rely on it without a follow-up call.
A web application is where most organizations expose their data to the internet, so it is where attackers look first. We approach each engagement as a reviewer who has an account and intends to abuse it, probing how the application handles untrusted input, how it decides who may see what, and where its logic can be pushed past the paths the developers intended.
Our testers work through the OWASP Web Security Testing Guide by hand, using automated tooling only to map the surface and confirm coverage. The hours go into the problems tools cannot judge: whether one tenant can read another's records, whether a low-privileged user can reach an admin function, and whether a multi-step workflow can be completed out of order to skip a payment or an approval.
You receive findings that an engineer can reproduce from the report and an auditor will accept. Each issue carries a CVSS v4.0 score, the exact request that triggered it, the business impact in plain language, and a fix that fits your stack. Critical issues are raised the moment we confirm them, so you are never waiting on the final document to start remediation.
How US engagements run
- Delivered remotely from India, 9.5 hours ahead of US Eastern in US daylight time and 10.5 hours in winter; calls and testing windows are set around your time zone at scoping
- Fixed-price proposals in US dollars, with scope, dates and the free retest written in before any work begins
- Written authorization signed by someone with authority over every target, because the federal Computer Fraud and Abuse Act and state laws make permission the dividing line
- Reports that name the requirement a test supports, such as PCI DSS 11.4, the FTC Safeguards Rule or SOC 2, without claiming a QSA, ASV or C3PAO role we don't hold
What's included
Our approach
- Scope & accountsWe agree targets and rules of engagement, then collect test accounts for each role.
- MappingWe enumerate pages, parameters and APIs behind the app to build a complete test surface.
- Manual testingTesters work the WSTG checklist by hand, chaining issues into realiztic attack paths.
- VerificationEvery finding is reproduced and evidenced before it reaches your report.
- Report & debriefWe deliver the report and walk your team through risks, fixes and priorities on a call.
What you receive
- Executive summary written for a non-technical reader
- Risk-rated findings with CVSS v4.0 scores and reproduction steps
- Developer-ready remediation guidance per issue
- Illustrative sample evidence for each finding
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- OWASP WSTG
- OWASP ASVS
- OWASP Top 10
- PTES
- NIST SP 800-115
- CVSS v4.0
- CWE
- SOC 2
Frequently asked questions
Do you need accounts and a test environment?
Authenticated testing finds far more than an anonymous scan, so we ask for one account per role, ideally in a staging environment that mirrors production. If only production is available we agree safe limits in writing before any testing begins.
Will testing take the application down?
Our aim is to find flaws, not to disrupt you. We avoid denial-of-service techniques, throttle noisy checks and schedule any higher-risk tests with your team. A named contact can reach the tester throughout so anything unexpected is paused at once.
How do you handle the data in our application?
We treat your data as confidential, work under an NDA on request, and avoid exfiltrating real records. Where we must prove access we capture the minimum evidence needed and redact it, then destroy test artifacts after the engagement closes.
Will a SOC 2 auditor accept your application pentest report?
Penetration testing isn't written into the SOC 2 criteria, yet it is common for auditors and enterprise buyers to look for a recent test. Our report records scope, dates, method and rated findings, and the retest letter shows what was fixed. Your auditor still decides which evidence they accept.
Can testing fit around our US release schedule?
Yes. Testing windows, call times and code-freeze periods are agreed around your time zone at scoping. We deliver from India, which is 9.5 hours ahead of US Eastern during US daylight time and 10.5 hours in winter, and any critical issue is passed to your nominated contact the day it is verified.