Overview
Your organisation’s websites and digital services are vital for day-to-day operations. Yet they can also be an entry point for those who seek to misuse information. Our Web Application & API Penetration Testing service provides a thorough, independent review of your online systems. We look at how your site handles information and whether it can withstand unwanted attention. The goal is to identify and fix weaknesses before they are exploited.
We work with a wide range of web-based tools, including public websites, customer and supplier portals, internal management systems and application programming interfaces (APIs). No matter how simple or complex your platform, we tailor our work to suit its purpose and usage.
Key benefits
- Reduce your risk of data breaches and unauthorised access.
- Demonstrate compliance with regulations and customer requirements.
- Protect brand trust by proactively addressing vulnerabilities.
- Gain clear, prioritised guidance to improve your security.
What we examine
- Test resilience against common attack methods such as injection or cross-site scripting.
- Examine how information is exchanged and stored.
- Identify logical weaknesses such as broken access controls and misuse of privileges.
- Compare your application against widely recognised security risk lists to ensure nothing obvious is missed.
Assessment types
There are various ways to test a web application or API. We group assessments based on whether they originate from outside your organisation or from within, and whether the tester uses valid user credentials. For multi-tenant platforms and APIs, we also examine how well data is separated and protected across tenants and endpoints.
- External authenticated (most common) – we log in as each user role (e.g., standard, editor, admin, super admin) to mirror a real user over the internet and uncover weaknesses that could be abused with valid credentials.
- Multi‑tenant – we log in as at least two separate tenants with each role to test cross-tenant isolation and data separation.
- External unauthenticated – we assess your public‑facing application from the internet without valid credentials to identify exposures accessible to anyone.
- Internal unauthenticated – we simulate an insider threat or a device already inside your network to reveal weaknesses accessible without login, such as misconfigurations or default credentials.
- Internal authenticated – we test internal applications using valid local or domain credentials to uncover privilege abuse and lateral movement.
- API‑only assessments – we examine your application’s APIs to ensure secure authentication, authorisation and data handling.
How we work
Every engagement follows a clear process. We begin by listening to you so we understand your aims and the nature of your systems. Our consultants then perform hands‑on testing, using the same methods a real intruder might try, but in a controlled manner. Afterward, we prepare a clear, plain‑English report that explains what we found, why it matters and how to resolve it. Finally, we remain available to answer questions and verify fixes where needed.
- Listen to your aims and understand the nature of your systems.
- Perform hands‑on testing using the same methods a real intruder might try, but in a controlled manner.
- Prepare a clear, plain‑English report explaining what was found, why it matters, and how to resolve it.
- Remain available to answer questions and verify fixes where needed.
Our work can be carried out in different ways. A ‘black box’ assessment mimics an anonymous outsider with no prior knowledge. A ‘white box’ assessment offers our consultants some internal insight, such as access to accounts or code. We often recommend a ‘grey box’ approach, which combines elements of both and provides the most balanced view of your application’s resilience.
- External authenticated (most common) – we log in as each user role (e.g., standard, editor, admin, super admin) to mirror a real user over the internet and uncover weaknesses that could be abused with valid credentials.
- Multi-tenant – where your application serves multiple tenants, we ask for accounts for each role in at least two tenants to validate tenant-to-tenant isolation and ensure each tenant’s data and functions remain private.
- External unauthenticated – replicates how an internet‑based attacker without any credentials probes your application for exposed weaknesses before log‑in.
- Internal unauthenticated – we conduct testing from inside your network without credentials to simulate an insider threat or compromised device and uncover vulnerabilities accessible without a valid account.
- Internal authenticated – builds on internal testing by providing valid credentials to see whether an insider or compromised user can do more than intended.
- API‑specific – we inspect each endpoint, validating inputs, responses and business logic, confirming that authentication and role‑based authorisation are enforced and data is exchanged and stored securely.
- These variations allow us to tailor your assessment to your technology, user roles and threat model.