Overview
Customer portals, booking systems and internal line-of-business tools hold much of the personal data a UK organisation is answerable for. We test them role by role in a window agreed in UK time, and write the report so it can sit in your UK GDPR Article 32 file, your ISO 27001 evidence pack or a buyer's security questionnaire without rework.
A web application is where most organisations expose their data to the internet, so it is where attackers look first. We approach each engagement as a reviewer who has an account and intends to abuse it, probing how the application handles untrusted input, how it decides who may see what, and where its logic can be pushed past the paths the developers intended.
Our testers work through the OWASP Web Security Testing Guide by hand, using automated tooling only to map the surface and confirm coverage. The hours go into the problems tools cannot judge: whether one tenant can read another's records, whether a low-privileged user can reach an admin function, and whether a multi-step workflow can be completed out of order to skip a payment or an approval.
You receive findings that an engineer can reproduce from the report and an auditor will accept. Each issue carries a CVSS v4.0 score, the exact request that triggered it, the business impact in plain language, and a fix that fits your stack. Critical issues are raised the moment we confirm them, so you are never waiting on the final document to start remediation.
How we work with UK clients
- Testing windows set in UK time at scoping. India runs 4.5 hours ahead during British Summer Time and 5.5 hours ahead in winter, so our days overlap.
- Fixed proposals in GBP, excluding VAT; the reverse charge usually applies to UK business buyers.
- No traffic leaves our hands until written authorisation is signed by someone entitled to give it, as the Computer Misuse Act 1990 requires.
- Findings labelled for the evidence you file: ISO 27001 Annex A, UK GDPR Article 32, PCI DSS or a supplier questionnaire.
What's included
Our approach
- Scope & accountsWe agree targets and rules of engagement, then collect test accounts for each role.
- MappingWe enumerate pages, parameters and APIs behind the app to build a complete test surface.
- Manual testingTesters work the WSTG checklist by hand, chaining issues into realistic attack paths.
- VerificationEvery finding is reproduced and evidenced before it reaches your report.
- Report & debriefWe deliver the report and walk your team through risks, fixes and priorities on a call.
What you receive
- Executive summary written for a non-technical reader
- Risk-rated findings with CVSS v4.0 scores and reproduction steps
- Developer-ready remediation guidance per issue
- Illustrative sample evidence for each finding
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- OWASP WSTG
- OWASP ASVS
- OWASP Top 10
- PTES
- NIST SP 800-115
- CVSS v4.0
- CWE
- UK GDPR Art. 32
Frequently asked questions
Do you need accounts and a test environment?
Authenticated testing finds far more than an anonymous scan, so we ask for one account per role, ideally in a staging environment that mirrors production. If only production is available we agree safe limits in writing before any testing begins.
Will testing take the application down?
Our aim is to find flaws, not to disrupt you. We avoid denial-of-service techniques, throttle noisy checks and schedule any higher-risk tests with your team. A named contact can reach the tester throughout so anything unexpected is paused at once.
How do you handle the data in our application?
We treat your data as confidential, work under an NDA on request, and avoid exfiltrating real records. Where we must prove access we capture the minimum evidence needed and redact it, then destroy test artefacts after the engagement closes.
Can testing run during UK office hours?
Yes. Testing windows are agreed in UK time at scoping. India is 4.5 hours ahead of the UK during British Summer Time and 5.5 hours ahead in winter, so our working day overlaps yours. If you prefer quiet periods, we can also test in your early morning or evening.
Does an application pentest help with UK GDPR?
It can. Article 32 of the UK GDPR expects "a process for regularly testing, assessing and evaluating the effectiveness" of security measures. A dated application test with retested fixes is a clear record of that process for the personal data your application handles.