Find what black-box scanners miss.
Source-assisted assessments, iterative exploitation, and audit-ready deliverables. Our assessors test with full read-only access to your source and your running application — surfacing logic flaws, unsafe patterns, and dead code paths a black-box test cannot reach.
Four iterative exploitation passes per engagement
Audit-ready reports for SOC 2, ISO 27001 & GDPR
Consultative review with your engineering team
What We Test
Aligned to OWASP WSTG v4.2, OWASP Top 10 (2021), OWASP API Top 10, NIST SP 800-115 & CVSS v3.1.
Authentication & Sessions
Credential handling, session fixation, token validity, MFA bypass.
Authorization & Access
IDOR, privilege escalation, tenant isolation, RBAC, BOLA/BFLA.
Input Handling
SQL / NoSQL / command / LDAP injection, XSS, SSRF, XXE, uploads.
Business Logic
Race conditions, workflow bypass, price/quantity tampering, state abuse.
API Security
OWASP API Top 10, parameter pollution, mass assignment, rate limiting.
Client-Side
CSP, CORS, clickjacking, DOM issues, exposed secrets.
Infra-Adjacent
Misconfigured headers, verbose errors, debug endpoints, stale dependencies.
Chained Attacks
Lower-severity issues combined into compound, high-impact exploits.
How We Test — Iterative Model
Four passes. Each goes deeper than the last.
Reconnaissance & Surface Mapping
Enumerate endpoints, parameters, auth flows, client-side logic and stack; establish baseline behavior.
Exploitation Breadth
Systematic attempts across the full OWASP Top 10 and API Top 10 — validated by real exploitation, not pattern-matching.
Depth & Chaining
Revisit promising findings, chain lower-severity issues, push authorization boundaries and business logic.
Verification & Evidence
Every finding re-verified with a reproducible proof-of-concept, request/response evidence and remediation guidance.
Severity Model
CVSS v3.1 with exploitability context — prioritized by real-world risk.
Timeline
Typical end-to-end: 1–3 weeks from start to consultative review.
Kickoff
Scope confirmed on a short call
Testing
3–12 business days
Report
< 24h after testing
Review
Within 5 days
Re-test
30 days, included
Kickoff
Scope confirmed on a short call
Testing
3–12 business days
Report
< 24h after testing
Review
Within 5 days
Re-test
30 days, included
Choose Your Engagement
Pick a size by scope, then a tier by depth. Final scope is confirmed on a short discovery call before signature.
Re-tests are on us.
Every Critical and High finding is re-verified within 30 days of report delivery — at no extra cost. No change order, no re-scope fee, written close-out for your auditors.
Medium
25–100 endpoints · 4–10 services
Large
100+ endpoints · 10+ services
Prices in USD, exclusive of local taxes. All deliverables for the selected tier are included.
What’s included in each tier
Both tiers are available at every size.
Production URL plus read-only source access. Depth equivalent to grey-box on the unauthenticated surface, with source review substituting for credentialled coverage. Includes 30-day re-test of Critical & High findings.
Everything in Source-Assisted, plus credentials for every role tier, engineering walkthrough & design docs, authenticated cross-role and cross-tenant testing, and 10 hours of consultative guidance.