Overview
Plenty of UK organisations still depend on installed desktop software: practice management in legal and accountancy firms, dealing tools in financial services, and clinical or stock systems in health and retail. These clients often trust the user's machine too much. We look at what they store locally, what they send across the network and whether a standard user can turn them against the server.
A thick client puts code and often credentials on the user's own machine, which changes the threat model entirely. We start on the host, inspecting how the application stores configuration, connection strings, tokens and cached data, and whether a standard user can read secrets, tamper with files or escalate privileges through weak permissions, services or installers.
We then turn to the binary and the wire. Reverse engineering reveals hard-coded secrets, hidden functionality and weak cryptography, while runtime analysis shows how the application behaves when its inputs and memory are manipulated. For two-tier designs that connect directly to a database, we test whether the client's trust can be abused to run queries or reach data the user should never touch; for three-tier designs we test the service in between.
The goal is to show what an insider or a compromised endpoint can actually achieve, not to list theoretical weaknesses. Every finding is reproduced, scored with CVSS v4.0, and paired with a fix aimed at the right layer, whether that means moving trust to the server, tightening file permissions, or removing secrets from the client. Critical issues are reported as soon as we confirm them.
How we work with UK clients
- Testing windows set in UK time at scoping. India runs 4.5 hours ahead during British Summer Time and 5.5 hours ahead in winter, so our days overlap.
- Fixed proposals in GBP, excluding VAT; the reverse charge usually applies to UK business buyers.
- No traffic leaves our hands until written authorisation is signed by someone entitled to give it, as the Computer Misuse Act 1990 requires.
- Findings labelled for the evidence you file: ISO 27001 Annex A, UK GDPR Article 32, PCI DSS or a supplier questionnaire.
What's included
Our approach
- Environment setupWe install the client with test accounts and map its architecture and dependencies.
- Host reviewWe inspect local storage, permissions and privilege paths on the machine.
- Binary & runtimeWe reverse engineer and instrument the binary to observe its real behaviour.
- Traffic testingConnections to databases and services are intercepted, replayed and manipulated.
- Report & debriefFindings are evidenced, scored and explained to your application owners.
What you receive
- Architecture summary with identified trust boundaries
- Risk-rated findings with reproduction evidence
- CVSS v4.0 scores and layer-specific remediation
- Analysis of client-side versus server-side enforcement
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- OWASP ASVS
- PTES
- NIST SP 800-115
- MITRE ATT&CK
- CVSS v4.0
- CWE
- UK GDPR Art. 32
Frequently asked questions
What do you need to test a thick client?
An installer or build, test accounts for each role, and a test instance of any database or service it connects to. If the application only runs against production data, we agree safe limits in writing and favour non-destructive techniques throughout.
Can you test an old application you do not have source for?
Yes. Legacy clients are common and we routinely test compiled binaries without source. Reverse engineering, host inspection and traffic analysis let us assess an application whose developers have long since moved on.
Why test the database connection?
Two-tier applications often trust the client to behave, which means a user who can read the connection string or craft their own queries may reach data the interface never shows. Testing that path reveals whether real enforcement lives on the server or only in the client.
Can testing run during UK office hours?
Yes. Testing windows are agreed in UK time at scoping. India is 4.5 hours ahead of the UK during British Summer Time and 5.5 hours ahead in winter, so our working day overlaps yours. If you prefer quiet periods, we can also test in your early morning or evening.
Does an application pentest help with UK GDPR?
It can. Article 32 of the UK GDPR expects "a process for regularly testing, assessing and evaluating the effectiveness" of security measures. A dated application test with retested fixes is a clear record of that process for the personal data your application handles.