What gets tested
Three surfaces, and nothing outside what you put in writing. Anything not named in the scope is explicitly out of scope, including systems that merely happen to share an IP range or a domain with a target.
- Web applications: authentication, session handling, access control between accounts and roles, input handling, business logic
- APIs: authorization on every endpoint, object-level access control, rate limiting, token handling, schema abuse
- Networks: exposed services, default and weak credentials, missing patches, segmentation that does not hold
How a penetration test differs from a vulnerability scan
A scanner matches your systems against a database of known issues and reports what it recognizes. It is fast, repeatable and blind to anything it has no signature for.
A penetration test adds a human who chains findings together. A scanner reports a weak password policy on one host and an open management port on another; a tester uses the first to walk through the second and shows you the account it reached. Chaining is the part a scanner cannot do, and it is usually the part that changes what you fix first.
Testing against the OWASP Top 10
Application testing is organized around the current OWASP Top 10, the community list of the risk categories that turn up most often in real applications. The 2025 edition leads with broken access control and security misconfiguration, and adds software supply chain failures as its own category.
The list is a floor, not a ceiling. It gives the test a defensible structure and gives your developers categories they already know, but a finding that matters to your business and is not on the list still goes in the report.
- A01:2025 Broken Access Control
- A02:2025 Security Misconfiguration
- A03:2025 Software Supply Chain Failures
- A04:2025 Cryptographic Failures
- A05:2025 Injection
- A06:2025 Insecure Design
- A07:2025 Authentication Failures
- A08:2025 Software or Data Integrity Failures
- A09:2025 Security Logging and Alerting Failures
- A10:2025 Mishandling of Exceptional Conditions
Authorization comes first
Unauthorized testing is a crime, not a favour. Every engagement starts with a signed agreement and written rules of engagement that name the targets, the test window, the techniques that are permitted, and who to call if something breaks.
That document protects both sides. It is also what lets a tester move quickly: when the boundary is written down, nobody has to stop and ask whether the next step is allowed.
What you get at the end
The deliverable is a written report, not a tool export. Every finding is ranked by severity and comes with the steps to fix it, so the report can be handed straight to the people who will do the work.
One retest is included. Once your fixes are in, the same findings are re-exercised to confirm the fix holds rather than just closing the ticket.
- A written report
- Every finding ranked by severity
- Remediation steps for each finding
- One retest