Web Application Penetration Testing
OWASP-based, manual-first security testing for your website, online shop and customer portals.
Services
We cover your attack surface end to end: from your applications to your network, from one-off tests to continuous monitoring, and from audit preparation to the board report.
Penetration testing
Mobile Application Penetration Testing
OWASP MASVS-based security testing for your Android and iOS apps and their backend services.
API Penetration Testing
Testing for your REST and GraphQL APIs, focused on authorisation, business logic and data exposure.
External Network Penetration Testing
An attacker's view of your internet-facing servers, services and remote access points.
Internal Network Penetration Testing
How far can an attacker get once inside your network? Testing for Active Directory and internal systems.
Assessment and monitoring
Vulnerability Assessment
Broad scanning, verification and prioritisation of known vulnerabilities across your systems.
Continuous Security and Attack Surface Monitoring
Regular monitoring of your internet-facing assets, with alerts for new exposures and changes.
Compliance, consulting and reporting
Compliance Readiness: KVKK, ISO 27001, NIS2
Technical and process-focused preparation for KVKK, ISO/IEC 27001:2022 and, for Germany, NIS2/GDPR requirements.
Security Consulting
Architecture reviews, a security roadmap and hands-on technical guidance for your team.
Reporting: Executive Summary and Technical Report
Clear, actionable reports for two audiences at the end of every engagement.
Where should I start?
- We are about to launch a new website, online shop or customer portal.Web Application Penetration Testing
- Our mobile app is live in the stores and we're worried about the backend APIs.Mobile Application Penetration Testing
- We provide APIs to partners or to our own apps.API Penetration Testing
- We don't really know what of ours is visible from the internet.External Network Penetration Testing
- We'd like to know what happens if an employee's laptop is compromised.Internal Network Penetration Testing
- We want an overall security picture on a limited budget.Vulnerability Assessment
- Our systems change constantly and we want them watched regularly.Continuous Security and Attack Surface Monitoring
- We are preparing for a KVKK, ISO 27001 or NIS2 audit.Compliance Readiness: KVKK, ISO 27001, NIS2
Engagement models
One-off
A clearly scoped test and report for a specific release, application or infrastructure.
Periodic
Repeat testing every three or six months to track how change affects your security.
Continuous
Year-round visibility through attack surface monitoring and regular vulnerability scanning.
See your weaknesses before attackers do.
Let's define the scope together. You'll receive a written proposal with the right type of test and a clear timeline.