Penetration Testing as a Service (PTaaS)
Manual cyber security testing for web, API, network, mobile, cloud and AI systems — plus a CVE watch on everything you run. Real findings your team can fix this sprint, not a scanner report nobody opens.
Book a free scoping callWhat's wrong with pentesting these days
The industry sells you a PDF and disappears. Here's what's actually going wrong — with receipts.
-
Vibe-coded apps are getting hacked
Thousands of AI-generated apps went live with no authentication at all. One study found 5,000+ apps built on Lovable, Replit, Base44 and Netlify sitting open on the web — about 40% leaking medical, financial and corporate data. A separate scan of 1,400 vibe-coded production apps found over 2,000 critical vulnerabilities. If your app was built with AI and never manually tested, assume it has holes.
Reference: WIRED — Thousands of Vibe-Coded Apps Expose Corporate and Personal Data → -
An AI chatbot that handed over celebrity accounts
Attackers asked Meta's AI support bot to change the email on Instagram accounts — and it did. 20,225 accounts taken, including big-name profiles. No exploit code, just the right words to a bot with too much access. If your product has an AI assistant or agent, it's an attack surface like any other.
Reference: Ars Technica — Meta AI support chatbot gave hackers access to Instagram accounts → -
A new CVE drops and nobody tells you
Critical flaws ship against products you run every week — an unpatched PeopleSoft zero-day (CVSS 9.8) hit 100+ organizations including the FBI, and one path-traversal CVE reached eight Atlassian products at once. Most teams find out when it's already exploited. That's why we run a CVE watch on your stack: we track advisories for the software you actually use and alert you the day a relevant CVE lands, with patch priority and optional validation testing.
Reference: The Hacker News — Critical Atlassian flaw lets unauthenticated attackers read files → Reference: ShinyHunters' PeopleSoft zero-day bypasses WAF rules → -
Scanners still can't find the real bugs
A report with 400 findings sounds thorough until 380 are theoretical. Scanners work off a sitemap and known patterns — they miss the undocumented API, the broken auth logic, the "change this ID and read anyone's data" bug. We verify everything by hand; if we can't exploit it, it doesn't go in your report.
-
AI agents are doing the breaking-in now
Hundreds of AI agents built and fired exploits at PaperCut servers — 395 organizations hit across 48 countries. Even a vulnerability coordination team got hacked the same way, through two zero-days in their helpdesk software. Attacks move faster than your annual test.
Reference: BleepingComputer — AI-powered attack exploited PaperCut flaws to hack 395 organizations → -
Third-party access nobody watches
Denmark's national person register lost data on 8.8 million people. No zero-day — attackers abused the legitimate login of a small contractor and ran automated searches for ten days straight. Your integrations and vendors are part of your attack surface too.
Reference: Denmark CPR Register breach via abused third-party access → -
The annual pentest is stale on arrival
You ship weekly; the test happened last quarter. By the time the PDF lands, three deploys have changed the app. PTaaS exists because testing has to follow your release cycle — test, fix, retest, repeat.
Web Application Penetration Testing
We log in like a user, then try to break the rules — skip the login, act like an admin, buy things for free. Full coverage, not just the OWASP top ten.
Learn more…Injection
- SQL injection — union, boolean, time-based, error-based, second-order, stacked queries
- NoSQL injection — operator injection, JSON type juggling, $where
- Command injection — OS commands, argument injection, out-of-band callbacks
- LDAP / XPath / template injection
- SSTI — Jinja2, Twig, Freemarker, Velocity, ERB → RCE
- XXE — file read, SSRF, billion laughs
- XSS — reflected, stored, DOM-based, mutation XSS, CSP bypass, markdown/template XSS
Authentication & Session
- Broken authentication — credential stuffing, spraying, user enumeration
- Password reset flaws — token theft, host header poisoning, reuse, no expiry
- OTP / MFA bypass — brute force, replay, response tampering, fallback abuse
- Session issues — fixation, hijacking, missing invalidation on logout, predictable IDs
- JWT attacks — alg:none, RS256→HS256 confusion, weak secrets, kid injection, claim tampering
- OAuth / SSO flaws — redirect_uri bypass, state CSRF, token theft, account linking abuse
Authorization & Access Control
- IDOR / BOLA — horizontal and vertical, encoded IDs, nested objects, batch endpoints
- Privilege escalation — user → admin, role tampering, mass assignment
- Forced browsing — hidden pages, backup files, admin panels, .git/.env exposure
- Function-level access (BFLA) — API calls the UI never makes
- Multi-tenant isolation — cross-org and cross-tenant data access
- Path traversal / LFI / RFI — file read, log poisoning, wrapper abuse
Business Logic
- Race conditions — double-spend, coupon reuse, limit overrun, TOCTOU
- Price / quantity manipulation — negative values, currency confusion, discount stacking
- Workflow bypass — skipping steps, out-of-order states, re-payment abuse
- Refund / quota / trial abuse, referral fraud, time-travel via client clock
Server-Side & Infrastructure
- SSRF — cloud metadata, internal services, DNS rebinding, protocol smuggling
- Insecure deserialization — Java, PHP, Python pickle → RCE
- File upload bypass — extension, content-type, magic bytes → webshell/XSS
- Open redirect, CRLF/header injection, HTTP response splitting
- HTTP request smuggling — CL.TE, TE.CL, HTTP/2 downgrade
- Cache poisoning & deception, host header attacks, web cache issues
- Security misconfiguration — debug mode, default creds, directory listing, verbose errors, CORS misconfig, missing security headers
Client-Side
- CSRF — state-changing actions, login CSRF, JSON endpoints
- Clickjacking, postMessage origin flaws, DOM clobbering
- Sensitive data exposure — keys in JS bundles, source maps, browser storage, referrer leakage
API Security Testing
APIs are where most real breaches start. We find the endpoints your docs don't list, then poke every one of them.
Learn more…Authorization
- BOLA / IDOR — every ID, nested resource, GraphQL node, batch request
- BFLA — function-level checks missing on admin or internal endpoints
- Mass assignment — role, plan, tenantId, isVerified injected into the body
- Broken tenant isolation — org ID trusted from the client
Authentication & Abuse
- Weak API keys / JWT — hardcoded, leaked, guessable, alg confusion
- Rate limiting gaps — brute force, enumeration, quota bypass, credit abuse
- Excessive data exposure — responses returning more than the UI shows
- Undocumented / legacy endpoints — old versions still live in production
Injection & Protocol
- SQL/NoSQL injection in query params, headers, GraphQL arguments
- SSRF via webhooks, URL previews, import features
- XXE in SOAP/XML bodies, bulk import parsers
- GraphQL-specific — introspection leaks, batching abuse, depth/complexity bombs, alias rate-limit bypass
- HTTP parameter pollution, content-type confusion, method override
- Race conditions on transfers, redemptions, one-time operations
Network Penetration Testing
Outside in, then inside across. We map what's exposed, what's behind the firewall, and how far one compromised machine can travel.
Learn more…External
- Open ports & services — old versions, known CVEs, banner leaks
- Default & weak credentials — routers, VPNs, admin panels, IoT
- Weak TLS — old protocols, bad ciphers, cert issues
- Email security — SPF/DKIM/DMARC gaps, spoofing
- Subdomain takeover, DNS misconfig, exposed remote access (RDP, SSH)
Internal & Active Directory
- Lateral movement — pass-the-hash, token relay, SMB abuse
- Kerberos attacks — Kerberoasting, AS-REP roasting, delegation abuse
- ACL abuse — GenericAll, DCSync rights, shadow credentials
- Segmentation gaps — can IT reach finance? can the printer reach the DC?
- Privilege escalation — local exploits, service misconfigs, writable shares
- Credential harvesting — cached creds, resolvable secrets, Wi-Fi keys
Mobile & Thick Client Testing
APKs, IPAs, desktop apps and installed software. We pull the binary apart, watch its traffic, and hunt for what it tries to hide.
Learn more…Data & Storage
- Insecure local storage — plaintext creds, tokens, PII in SharedPreferences / UserDefaults / SQLite
- Hardcoded secrets — API keys, tokens, backdoor credentials in the binary
- Backup exposure — adb backup, iCloud/iTunes backups, log leakage
- Clipboard & screenshot leakage, keyboard cache
Network & Crypto
- SSL pinning bypass — MITM on Android/iOS, custom TrustManagers
- Cleartext traffic, weak TLS, hostname verification off
- Weak crypto — ECB, static IVs, MD5/SHA1, hard-coded keys, bad randomness
Platform & Runtime
- Exported components — activities, services, receivers, providers
- Intent injection & deeplink abuse, WebView flaws, JS bridges
- Root / jailbreak detection bypass, repackaging, runtime manipulation
- Thick client protocol interception — replayed and tampered client–server traffic
- Client-side authz — checks in the app the server never enforces
- Insecure deserialization and memory inspection for tokens in RAM
- Third-party library CVEs — vulnerable SDKs shipped inside the app
LLM / AI Security Testing
Your chatbot, copilot or agent can be talked into things. We test every way it can leak, obey the wrong person, or act on someone else's behalf.
Learn more…Injection & Control
- Direct prompt injection — override system instructions, ignore guardrails
- Indirect prompt injection — payloads hidden in retrieved documents, web pages, emails the model reads
- Jailbreaks — role play, encoding tricks, multi-turn steering
- System prompt & tool leakage — extract instructions, internal tooling, other users' context
Agency & Actions
- Excessive agency — can the agent reset accounts, change data, spend money? We test every permission it holds (the Meta AI account takeover class)
- Tool / plugin abuse — SSRF and RCE through tool calls, MCP abuse, code interpreters
- Confused deputy — the helper has more power than the user; we make it exercise that power for us
Data & Access
- Data exfiltration — sensitive input leaking through responses, files, URLs
- IDOR on chat history — read other users' conversations, sessions, embeddings
- RAG poisoning & training data leakage, membership inference
- Guardrail bypass — tested against the actual deployed model and filters
- Model DoS — context flooding, resource exhaustion
Cloud Security Assessment
AWS, Azure, GCP. We look for the open door, the over-broad role, and the path from "read-only" to "account owner".
Learn more…Identity & Access
- Over-privileged IAM roles, privilege escalation paths to admin
- Missing MFA, long-lived access keys, unused credentials
- Cross-account trust abuse, role chaining, assumed-role gaps
Exposure
- Public storage — S3/Blob/GCS buckets, snapshots, backups
- Exposed databases — world-readable, no auth, listening publicly
- Metadata service abuse — IMDSv1, SSRF-to-credentials
- Security group / firewall gaps, open management ports
- Serverless & function flaws — event injection, over-broad execution roles
Containers & Kubernetes
- Vulnerable images & supply chain risk in registries
- RBAC gaps, privileged pods, service account token abuse
- Exposed dashboards & API servers, kubelet access
- Secrets in CI/CD, IaC misconfig, GitOps repo exposure
CVE Watch for Your Stack
Pentests are point-in-time. Software keeps changing. We watch the CVEs for the products you actually run — frameworks, OS packages, plugins, appliances — and tell you the day a relevant one drops.
Learn more…What you get
- Asset-to-CVE mapping — we inventory your stack once, then match every new advisory against it
- Same-day alerts — critical and actively-exploited CVEs (including CISA KEV additions) hitting your products
- Patch priority — what's exposed, what's exploitable, what can wait — ranked, not just a feed dump
- Validation testing — optional: we verify whether the CVE actually affects your configuration before you push an emergency change
- Monthly digest — everything that dropped against your stack, what you fixed, what's still open
How an engagement runs
No surprise scope, no scary language, no waiting three weeks to hear what broke.
Scope in writing
Free scoping call first. You get a one-page plan — what we test, what we don't, the timeline — before any commitment.
Manual first
Tools map the surface; people break it. Every finding in your report was reproduced by a tester. Raw scanner output never ships.
Same-day criticals
If we find something bad mid-test — live data exposure, auth bypass — you hear it that day, not in the final PDF.
Retest included
You fix, we retest, you get a clean per-finding status. That's the proof your auditors and customers ask for.
Tell us what you're shipping
Free scoping call, no cost and no hard sell. You get a written plan of what we'd test and how before anything starts.
Book a scoping call