Retainer capacity is full until mid-2027.Fixed-scope projects available on request.
Web & API Penetration Testing
Find vulnerabilities in your application before attackers do.
Manual testing of web apps and APIs.
- OWASP Web & API Top 10
- retest included
- fixed price after scoping
- from €2,900
This assessment can be booked on its own, or scheduled for you inside the Retained Security Partner retainer at the point where it adds the most.
The Challenge
Why the application gets tested
Your application holds customer data and runs part of your business, so it has to protect the confidentiality, integrity and availability of that data when someone tries to break it. A pentest checks that it does, and three situations usually decide when one is booked.
A customer wants evidence
Security questionnaires and supplier contracts ask for an annual test by an independent party, and expect a dated report with a named scope and a retest.
Your ISMS calls for it
ISO 27001 ISO 27001 The international standard for an information security management system. Certification is what a customer or investor asks for when they want proof that security is run as a managed system, with named owners, review cycles and evidence. controls A.8.8 (vulnerability management) and A.8.29 (security testing) expect periodic testing, and the pentest report is the evidence your auditor asks for.
A major release is coming
For B2B software, an independent test before a major release is established practice, and buyers often write it into the contract.
Secure Software Development Lifecycle Secure Software Development Lifecycle (SSDLC) Security built into how software is designed, reviewed and shipped: threat modelling while the design is still cheap to change, security review inside normal code review, and automated checks in the build. It catches the same class of flaw a pentest finds, months earlier and at a fraction of the cost to fix, and we set it up with your development team. catches most of these flaws earlier, in design review, code review and the build, so the pentest has less to find.
Engagement Model
Engagement options
Choose a scoped test when you need a report for customers or auditors, and a fast-track review when your developers need an answer during development.
Option A
Scoped Penetration Test
For compliance, customer audits and major releases.
- Fixed price, quoted from the size of the application
- Testing window booked in advance
- OWASP Web Security Testing Guide and API Security Top 10, plus tests built around your roles and business logic
- Report with findings, evidence and fixes that you can share with customers and auditors
Option B
Fast-Track Consultation
For active development and quick reviews.
- Quick answer on a specific feature or change
- Billed by the hour, scope agreed as you go
- NDA signed before we start
- Read-only access is enough
Scope
What's in scope
Browser-facing web applications and the APIs behind them. We confirm which of these apply during scoping.
Web Applications
Authentication bypass, broken access control, XSS, SQL injection, and business logic flaws in browser-facing apps.
REST APIs
Auth bypass, BOLA, BFLA, injection, mass assignment attacks.
GraphQL
Introspection abuse, batching attacks, authorisation bypasses, complexity limits.
WebSocket APIs
Message injection, CSRF, authentication persistence, per-message authorisation checks.
Microservices
Service-to-service trust, gateway bypass, JWT flaws. On request.
Requirements
Access and accounts we need
These inputs make the test faster, cheaper and better at finding vulnerabilities. Provide what you can: each one moves testing time from mapping your application to attacking it.
The URL and one test account per role, ideally in a non-production environment.
Or equivalent API documentation. If there is none, we map the API ourselves first.
What each endpoint does, the business process it supports, and the data it handles.
A table of every user role and what each can read, write, and administer; a spreadsheet or text file is fine. See how to scope an API test for a worked example.
Which data is isolated per organisation or user, and what must never cross a tenant boundary.
- Dedicated test environment with its own database
- Dummy data we can safely change or delete
Why role definitions matter
Authorisation flaws (BOLA, BFLA) are among the most serious findings in API testing. We find them by comparing what each role should reach with what it actually reaches, and the role matrix supplies the first half.
-
GET /orders/1042 - its own order: returned, correctly.
-
GET /orders/1043 - another tenant's order: returned, though it should be denied.
A second test account is what shows this flaw.
Pricing
Indicative pricing
What affects the final price
Application & API Surface
Number of pages, endpoints, roles, and protocols (web, REST, GraphQL, WebSocket). The price scales with the surface.
Documentation
An OpenAPI or Swagger spec shortens discovery. An undocumented API takes more reconnaissance and costs more.
Lead Time saves money
Booking at least three weeks ahead lowers the quote. Urgent engagements carry a premium.
Process
How We Collaborate
We review your API documentation, role matrix and architecture, then send a fixed-price quote.
You provide non-production access and one test account per role. We confirm scope and rules of engagement.
We test the application and its API against OWASP and against scenarios built from your role matrix and business logic.
Executive summary for management. Technical findings with reproduction steps and remediation guidance for your dev team.
We walk through findings together. After you remediate, one verification round within 14 days is included; additional rounds, major changes, or late retests are quoted separately.
Get started