A customer requests a pentest
Define the evidence they need and the application they want assessed before committing to a test.
Web application penetration testing
Your next security
review starts with
clear evidence.
A customer asks for a pentest. Your team needs answers. Get a scoped assessment, actionable findings, and a report you can work with.
One team for scoping, testing, and reporting.
Scope, price, and delivery dates agreed before testing.
YOUR ASSESSMENT / WHAT YOU RECEIVE01—03
A defined test.
A useful report.
- 01
Agree the scope.
Application, price and dates. Confirmed in writing.
- 02
- 03
Report. Explain. Prioritize.
Executive summary, technical findings and walkthrough.
STANDARD WEB APP ASSESSMENT$7,500 USD
View scope ↗01 Defined scope & authorization02 Manual + tool-assisted testing03 Report & walkthrough
Built around a real business need
When a security question
becomes a business priority.
An audit needs supporting evidence
Arrange a scoped assessment for your security review. Reporting requirements are agreed up front.
Your product is changing
Review application risk after a release, a new integration, or changes to user permissions.
Confidence in the process
Know how your
engagement is handled.
Clear agreements before testing.
Useful communication throughout.
Agree the work before it starts.
Targets, methodology, access requirements, price, and dates are set out in the engagement documents. Testing requires written authorization.
Plan how sensitive information is handled.
We establish confidentiality and any required data-processing arrangements before the engagement. Evidence and deliverables use agreed secure channels.
Raise critical findings during the test.
We agree contacts and a communication plan. Critical findings are reported during the engagement so your team can assess them promptly.
Review the findings before delivery.
Report preparation includes peer review. A walkthrough helps your team understand the findings and remediation priorities.
A defined engagement
Know exactly what
you’re buying.
Start with one production web application.
Agree the boundaries before work begins.
$7,500USD · agreed Standard scope
A focused engagement for one web application and its explicitly agreed external footprint.
Final scope and delivery dates confirmed in writing. Broader requirements are quoted separately.Included in the agreed Standard scope
- One production web application
- Listed external domains and associated API scope, where agreed
- Executive summary and technical findings report
- A walkthrough call to discuss findings and priorities
SCOPED SEPARATELY
Additional applications, extensive APIs, mobile apps, cloud-wide or internal network testing. Retesting is included only when specified in the statement of work.
Useful beyond the assessment
A report for leadership.
Detail for engineering.
Understand the risk.
Decide what to fix next.
↗ILLUSTRATIVE STRUCTURE
WEB APPLICATION
Security
assessment.
01Executive summaryRisk & business impact
02Technical findingsSeverity, impact & remediation
03Assessment scopeCoverage & limitations
Illustrative layout, not a completed client assessment.
See what matters.
Understand the business impact of the findings and the priorities for your security review.
Give your team a next step.
Give engineering clear findings and practical recommendations for what to fix next.
Talk through the results.
Review the results with us, understand the priorities, and ask questions about the findings.
A straightforward engagement
From first conversation
to a clear plan.
Tell us what you need.
We discuss your application, your deadline, and who needs the report. You receive a defined scope and written price.
We assess the application.
Our team tests the agreed scope and keeps you informed. Critical findings are raised during the assessment.
Know what to do next.
Receive your report and walk through the findings with us. Your team leaves with clear remediation priorities.
Before you decide
Good questions.
Clear answers.
Need more technical detail?
Our methodology explains what we assess.
Does my application fit the Standard scope?
The Standard engagement covers one production web application and its explicitly agreed external footprint. We confirm the roles, associated APIs, and boundaries before quoting. Larger requirements are scoped separately.
Can you meet our deadline?
Tell us when the report is needed. We confirm availability, access requirements, and delivery dates in writing before the engagement is booked.
Will the report meet our review requirements?
Share the request from your customer or auditor during scoping. We agree the reporting requirements and intended use before testing. Acceptance remains with the reviewer.
What happens after we receive the report?
We walk through the findings and remediation priorities with your team. Retesting is available where included in the statement of work; implementing fixes is separately agreed.
Start with the right scope
What needs testing?
Let’s make it clear.
Tell us about your application, who needs the report,
and when you need it. We’ll work from there.
A scope conversation.
No testing without written authorization.