Penetration testing for software agencies and their clients

What we test in client builds

We test bespoke web, mobile and API projects that agencies build for their clients.

The checks reflect what each client build carries, with the scope agreed per build.

Before go-live or handover

1. Define the build to be tested
   Every test starts with planning: we agree the scope, the systems to test and the rules that avoid disruption.
   
   We scope each test with you, either through our scoping questionnaire or in a scoping meeting where we ask the same questions.
   
   For the build you are delivering, testing can be black-box, grey-box or white-box, agreed at scoping.
2. Choose where the build is tested
   We test on live systems and on staging environments. Roughly 70% of our tests run on live systems and 30% on staging.
3. Plan against the handover date
   Make room for a penetration test before important business events or launches, including your client’s go-live.
   
   Testing takes from a few days to a few weeks, depending on the project. The average testing period is 1–2 weeks.
   
   When testing can start depends on our current schedule.
4. Test under the agreed conditions
   Testing is conducted under controlled conditions with agreed rules of engagement. We schedule around your business needs.

What your client receives

Your client may ask for a penetration test report as part of handover.

Our reports include an executive summary, the scope of work, the test type and methods, the methodology, how risk is calculated, a summary of findings, detailed results for each finding, and a conclusion.

Every report lists the vulnerabilities found, rates each by risk, and gives remediation steps. A penetration test report also sets out the exploitation methods demonstrated during testing, and a priority-based action plan.

The report spans 20–100+ pages, and each finding is rated by severity.

We deliver the report in the language you ask for: English, Estonian or another language, or more than one.

The report is evidence you can give your auditors, supervisors and customers. What they accept is their decision.

We provide testing evidence. We do not audit or certify compliance with any regulation or standard.

You can request our sample web application penetration test report through the contact form or by email.

After the report, we offer a consultation on the findings.

Retesting the fixes

After you fix the findings, we re-test them.

A retest covers the findings only, not the full application. It is usually quoted in the same offer as the test. The retest window is about 4 weeks, or sooner if you have fixed the findings earlier and our schedule has an opening.

Security testing for software development

Security testing for developers can include a penetration test of the client build before handover. Testers attempt to exploit weaknesses they find, so the developers can see the demonstrated impact in the report.

When your agency continues developing or maintaining a client’s build after launch, our recommendation is to test it 2–4 times a year, and after major changes. That could mean a new phase of features, an integration with the client’s existing systems, a rebuilt sign-in or user-account flow, or a major framework upgrade.

Experience and method

With over 7 years of experience in testing, we have built extensive expertise in web applications and websites, e-commerce platforms, mobile applications, APIs and SaaS solutions.

Our penetration tests can follow OWASP, ISSAF, PTES or OSSTMM at your request or on our recommendation. What we follow and how much of it we cover are agreed at scoping.

Testing uses Burp Suite, manual testing and our own tools.

Our pentesters hold certificates including PNPT, eCPPTv2, CAP, CompTIA PenTest+ and CompTIA Security+, and their published research includes five CVEs.

Questions

Will a penetration test delay our client’s handover, and when can you start?

Whether penetration testing delays handover depends on how the testing period is planned against the handover date.

Testing takes from a few days to a few weeks, depending on the project. The average testing period is 1–2 weeks.

When testing can start depends on our current schedule.

Testing is conducted under controlled conditions with agreed rules of engagement. We schedule around your business needs.

What will be in the report for our client’s build?

Every report lists the vulnerabilities found, rates each by risk, and gives remediation steps. A penetration test report also sets out the exploitation methods demonstrated during testing, and a priority-based action plan.

The report is evidence you can give your auditors, supervisors and customers. What they accept is their decision.

Can our client get the report in the language they need?

We deliver the report in the language you ask for: English, Estonian or another language, or more than one.

How is a retest handled after our developers fix the findings?

After you fix the findings, we re-test them.

A retest covers the findings only, not the full application. It is usually quoted in the same offer as the test. The retest window is about 4 weeks, or sooner if you have fixed the findings earlier and our schedule has an opening.

How is penetration testing priced for a client build?

To price a penetration test for your client’s build, we consider how many systems or applications are in scope, the testing type, the environment’s complexity and the timeline.

See the cost and planning questions for penetration testing.

Should we commission a penetration test or a vulnerability assessment for a client build?

Choose a vulnerability assessment to identify and prioritise weaknesses, or a penetration test when you also need testers to attempt exploitation and demonstrate the impact.

A vulnerability assessment scans your systems with Burp Suite, and an expert verifies and prioritises what the scan finds. A penetration test goes further: testers try to exploit what they find and show you the impact.

Read about penetration testing and vulnerability assessment before choosing a test for your client’s build.

Related services

• Web application security testing
• Mobile application security testing
• API security testing
• Penetration testing
• Vulnerability assessment