QA & Release Assurance

Penetration Testing

Authorized, scoped attacks on your web apps, APIs and cloud setup to show which weaknesses can really be exploited. You get evidence, fix guidance and a retest once your fixes are in.

Discuss your project Discuss a penetration test

Who commissions a penetration test

A customer, insurer or auditor wants independent evidence that people have tried to break into your product, and you need findings you can act on rather than a scanner printout.

SaaS companies facing an enterprise customer's security review
Teams launching a payments or health product who want an attacker's view first
Companies whose cloud setup grew quickly and was never independently tested

A typical scope and rules of engagement

Illustrative scope for a web product; yours is agreed and signed before testing starts.

In scope
- The web app and each user role, using test accounts you provide
- Public APIs and the back end your mobile app calls
- Named cloud accounts: storage, identity settings and exposed services
- Chatbot or agent features as a route to data or tools
Out of scope
- Denial-of-service or load that could disrupt real users
- Phishing or social engineering of your staff, unless agreed separately
- Physical access to offices, devices or networks
- Third-party services you don't own, without their owner's permission
Rules of engagement
- Signed authorization naming targets, test accounts and source IP addresses
- Testing windows agreed for production; staging used where representative
- Named contacts on both sides, reachable while testing runs
- Critical findings reported straight away, not held for the final report
- Test accounts and uploaded test data removed when testing ends

See your product the way an attacker would

Scanners find known patterns; attackers chain small weaknesses together. A penetration test, or authorized ethical hacking, shows which weaknesses in your web application, APIs, mobile back end or cloud setup can actually be exploited, and what an attacker could reach. It's useful before a launch, a customer security review or an audit. We work only within a written scope and rules of engagement you approve, use non-destructive techniques by default, and report each finding with evidence, reproduction steps and fix guidance.

AI-assisted recon, human-led exploitation

How AI assists

Speeds up reconnaissance: routes, parameters, technologies and exposed services mapped within the agreed scope.
Triages scanner output, removing duplicates and likely false positives so testers focus on real leads.
Suggests attack paths and test cases from the application's roles, workflows and known weakness patterns.
Drafts finding write-ups and fix guidance for testers to verify and complete.

What our experts own

Scope, rules of engagement and testing windows are agreed with you in writing before any testing starts.
Testers run every exploitation step themselves. AI tools don't act against your systems unsupervised.
Testers chain findings, judge real-world impact and decide what's worth reporting.
Severity reflects what an attacker could reach in your environment, not a generic score.

What you receive

Scoped testing, clear evidence and retests

Web application testing
Authentication, access control, injection, cross-site scripting, request forgery and business-logic flaws, following OWASP testing guidance.
API penetration testing
Broken object and function-level authorization, mass assignment, injection and token weaknesses in REST and GraphQL APIs.
Cloud and infrastructure review
Exposed services, network rules, storage permissions, identity and access settings, and leaked secrets in your cloud environment.
AI feature testing
Prompt injection, data leakage through answers, and over-broad tool or data permissions in chatbots, agents and other LLM features.
Evidence-based report
An executive summary plus technical findings, each with evidence, reproduction steps, severity, impact and fix guidance.
Retesting of fixes
Once you've fixed the findings, we retest each one and update the report, so you can show which issues are closed.

How a penetration test runs

01
Scope and rules
Agree targets, environments, test accounts, testing windows and contacts. Written authorization is in place before testing starts.
02
Reconnaissance
Map the attack surface within scope, including routes, APIs, roles, technologies and exposed services, with AI-assisted analysis.
03
Controlled exploitation
Testers attempt to exploit weaknesses without causing damage, and stop to contact you if anything could affect live users or data.
04
Report and retest
Deliver evidence-based findings with fix guidance, walk your team through them and retest once fixes are deployed.

Two ways to work with AI tools

AI helps draft tests and investigate defects. Choose where it may process your code and test data.

Private / Local AI Engineering
Privately hosted models inside infrastructure you control or an agreed isolated environment.
Discuss with this package
Claude Code / OpenAI Codex Engineering
Claude Code and/or OpenAI Codex with cloud settings your organization approves.
Discuss with this package

Not sure? We'll recommend one during scoping. Compare AI delivery options

Typical penetration test requests

Typical scenarios we scope, not client case studies.

A test report for an enterprise buyer
A SaaS company's new customer asks for a recent independent test before signing. We scope the product areas that customer will use, test them, and provide a report their security team can review, updated after the retest.
A cloud account set up in a hurry
A small team moved to the cloud with permissions granted as needed. We test from outside and from a low-privilege account to see whether storage, keys or admin consoles can be reached, and how far an intruder could move.
Small weaknesses that might add up
A web app has minor issues nobody prioritized: verbose errors, a weak reset flow, guessable IDs. We test whether they chain into account takeover, and report the chain with evidence and the simplest fix that breaks it.

Limits of a penetration test

Testers follow the attack paths open during the testing window; later releases and systems outside the scope can still hold weaknesses.
Endpoint-by-endpoint authorization testing across roles is API Security; a penetration test treats the API as one route in.
Whether an AI feature answers well, and keeps doing so after model or prompt changes, is AI Evaluation & Testing; we test it as an entry point.
Line-by-line reading of source code is Code Audit & Review; here testers attack the running system.

How security testing connects to design, QA and operations

Design: security that stays usable
Fixes that change sign-in, account recovery or permissions are designed with your designers, so security doesn't make the product harder to use.
QA: fixes that stay fixed
Our engineers can help fix findings, and QA adds regression tests so a later change doesn't reintroduce the same weakness.
Operations: detect, not just prevent
Findings feed logging, alerting and hardening of your cloud setup, so your team is more likely to notice an attack in progress.
Ongoing: retest after big changes
Retests after major releases, new integrations or infrastructure changes, on a schedule agreed with you, keep your security picture current.

FAQ

Frequently asked questions

Will a penetration test disrupt our users?

We use non-destructive techniques by default, test in staging where it's representative and agree testing windows for production. If something looks risky, testers stop and contact your named person before going further.

How long does a penetration test take?

It depends on the number of applications, user roles and environments in scope. After a scoping call, we agree a fixed scope, testing window and report date with you before work starts.

Will a penetration test make us compliant?

No test makes a product compliant on its own. We support your compliance work: reports are written so auditors and your customers' security teams can review them, and retest results show which findings are closed.

How are our findings and data handled, including by AI tools?

Findings go only to the contacts you name, through channels agreed at scoping. AI-assisted analysis runs within the boundary you choose: Private / Local AI Engineering on infrastructure you control or in an isolated environment we agree, or Claude Code / OpenAI Codex Engineering under agreed provider data-handling and retention terms.