As long as humans are writing code, there will be bugs — some of those bugs just happen to be security vulnerabilities. Let us find them before the attackers do. Trust us to enhance your application's security and protect your critical data.
T-14 days
Our scoping process begins with a detailed consultation to understand your unique business requirements and the specific functionalities of your web applications.
A scope of testing is defined to ensure sufficient coverage, along with a testing methodology that is tailored to
align with your specific security goals.
T-7 days
Ahead of testing, we work with you to ensure everything is ready for testing. In grey box tests, this can include setting up user accounts with varying access levels, preparing a test environment where all data flows can be executed, and sharing relevant documentation which may help with more in-depth evaluations.
Testing starts! Our certified penetration testers manually search for vulnerabilities to uncover security bugs deep in your code base.
Should any critical vulnerabilities be discovered, we communicate these
immediately to ensure swift mitigation.
T+14 Days
Upon completion of the testing phase, we deliver a detailed report that outlines all identified vulnerabilities, accompanied by options for remediation.
A key part of our service is the debrief call, where we walk through the report
together. This ensures that all findings are fully understood and that the necessary
steps for remediation are clearly communicated.
Without a mature application security program, non-functional requirements such as security can often be overlooked during the feature development process. Testing can help identify these hidden issues before someone else finds them.
Mature buyers expect robust security measures as a standard part of any software platform. Being on the forefoot of these expectations can better demonstrate your commitment to security, enhance your reputation as a reliable software provider.
Security isn't just a necessity — it can be seen as a competitive advantage. By highlighting your commitment to regular advanced security audits you can reassure users and differentiate your product in the marketplace.
Penetration testing can often serve as a valuable educational tool for development teams. By remediating vulnerability findings, developers gain insight into the mindset of attackers, enabling them to build more securely in the future.
Manual assessment forms the bulk of our penetration testing engagements: at least until our AI overlords replace us.
Project Black's high-level approach to assessing web applications is adapted from Dafydd Stuttard's (Founder/CEO of Portswigger) "The Web Application Hacker's Handbook". This approach is prioritised to focus on discovery of vulnerability classes which are widely agreed upon to be the most common/critical security risks present in web applications.
Listed below are some of Project Black's most important test categories mapped against the OWASP Top 10 and SANS CWE Top 25:
Access Control Testing
Access control vulnerabilities form a large portion of easily exploitable vulnerabilities that are discovered across Project Black's testing. Testing in this phase will focus on the discovery of authentication bypass vulnerabilities and authorisation issues (lateral, vertical, and cross tenant).
Input Handling
Input handling vulnerabilities are typically more difficult to exploit (thereby reducing likelihood of exploitation) however can result in significant impact to the application owner. As such they are evaluated as a part of Project Black's next testing phase.
Application Hosting/Security Configuration
The prevalence of PAAS consumption and dependencies on third parties' shifts testing focus in this phase to usage/configuration of said PAAS services and third-party dependencies.
Application Logic & Misc Vulnerability Classes
Finally, application specific functionality may expose the possibility for additional vulnerability classes like business logic issues.
Project Black uses the OWASP Testing Guide and internally developed tooling/methodology for specific test case guidance.
Simply fill out and submit the form, and we'll provide you with a quote within hours - unless you fill it in at 3am!