How we test, chapter by chapter
The method behind every assessment, written for the engineers who will read the report. Each chapter names the test areas, the checks and the limits.
Chapters
- Scoping and authorisationHow an engagement is bounded before the first request is sent: the scope record, roles and accounts, environments, rules of engagement, signed authorisation, evidence handling and the conditions that stop testing.
- Authentication and sessionsHow sign-in, recovery, multi-factor, federated login, sessions and tokens are tested across every entry point, including the mobile API and the legacy endpoint nobody remembers.
- Authorization and tenant isolationHow we test that every role can do only what it should, and that one customer organisation can never reach another's data, using a role matrix and at least two test tenants.
- Business logic and workflowsHow we test the rules your product enforces: approvals, payments, limits, plans and multi-step workflows that scanners cannot understand.
- API testingHow we test REST and GraphQL APIs against their documentation and their real behaviour: authorization per endpoint, data exposure, mass assignment, rate limits and versions.
- AI application testingHow we assess AI features as part of an application: data and tenant boundaries, retrieval, tool permissions, resilience to untrusted instructions and output handling.
- Reporting and retestHow findings are evidenced, rated and written up, how the readout works, and how fixes are retested and recorded so a reviewer can see what changed.
Standards we map to
Public references let a reviewer compare our coverage with something they already know.
- PTES: Pre-engagement Interactions
- NIST SP 800-115: planning phase of a technical security assessment
- OWASP WSTG v4.2: Information Gathering (WSTG-INFO)
- AWS, Microsoft Azure and Google Cloud published penetration testing policies
- OWASP WSTG v4.2: Identity Management (WSTG-IDNT), Authentication (WSTG-ATHN) and Session Management (WSTG-SESS)
- OWASP ASVS 5.0: Authentication, Session Management, Self-contained Tokens, and OAuth and OIDC chapters
- OWASP API Security Top 10 2023: API2 Broken Authentication
- CWE-287 Improper Authentication, CWE-307, CWE-384 Session Fixation, CWE-613 Insufficient Session Expiration
- NIST SP 800-63B (authenticator guidance, as a reference point)
- OWASP API Security Top 10 2023: API1 BOLA, API3 BOPLA, API5 BFLA
- OWASP ASVS 5.0: Authorization chapter
- OWASP WSTG: Authorization testing category
- CWE-639 Authorization Bypass Through User-Controlled Key, CWE-285 Improper Authorization
- OWASP WSTG: Business Logic Testing category
- OWASP ASVS 5.0: business logic and anti-automation requirements
- OWASP API Security Top 10 2023: API6 Unrestricted Access to Sensitive Business Flows
- CWE-840 Business Logic Errors
- OWASP API Security Top 10 2023
- OWASP ASVS 5.0: API and web service requirements
- OWASP WSTG: API testing guidance
- OWASP Top 10 for LLM Applications (edition stated in each proposal)
- OWASP guidance for agentic applications
- OWASP ASVS 5.0 and API Security Top 10 2023 for the surrounding application
- CVSS v4.0 as an input to severity
- CWE for weakness classification
- OWASP references per finding (WSTG, ASVS, API Top 10)
Get a fixed quote for your release.
A short form about the product and the deadline. We reply with scoping questions, then a fixed written quote.