Who we help with penetration testing
C-YBER provides penetration testing and vulnerability assessment of web applications, mobile apps and APIs for the businesses listed on this page. If you are a CTO, CISO or another technical buyer, explore the testing scope for your business below.
We test web applications, mobile apps and APIs. We do not audit or certify compliance with any regulation or standard.
A vulnerability assessment scans your systems with Burp Suite, and an expert verifies and prioritises what the scan finds. A penetration test goes further: testers try to exploit what they find and show you the impact.
Penetration testing
Penetration testing starts with an agreed scope and rules of engagement, followed by reconnaissance and attempts to exploit identified vulnerabilities. It includes a report and remediation support.
Vulnerability assessment
A vulnerability assessment includes expert manual analysis of scan results, a report and remediation assistance, with no active exploitation.
What testing covers
Applications and interfaces
- Web solutions: websites, web applications, online stores, online banking applications, any system with a web interface
- Mobile applications: iOS and Android
- APIs: data exchange and system integration interfaces
What we check
- Authentication and authorisation
- Input validation
- Encryption and data integrity
- Rate limiting and throttling
- Error handling and logging
- Server configuration and database security
- Logic flaws
- Chained vulnerabilities
Testing for your business
Choose the page that matches your business to explore the testing scope and questions relevant to you.
Fintech penetration testing
If you lead a fintech or payments product, you may be adding a money-movement feature or responding to a bank’s request for a penetration test.
- Customer web and online banking applications
- iOS and Android mobile apps
- APIs for KYC and payment flows
SaaS penetration testing
As a SaaS technical lead, you may need a test for an enterprise customer’s security review or an authentication or billing rewrite.
- Multi-tenant web applications
- Public APIs
- Mobile apps, where present
Penetration testing for software agencies
When your software agency is preparing a client build for launch or handover, the client may ask for a penetration test. A tender may also call for one.
- Bespoke web applications and websites
- Mobile apps for iOS and Android
- Data exchange and system integration APIs
Ecommerce penetration testing
For retail and marketplace technology leaders, a store launch, replatforming or peak season may prompt testing. Buying or selling a store may also be the trigger.
- Store web applications and custom checkout
- Inventory APIs
- Admin consoles
Penetration testing for public sector software suppliers
Your company supplies public bodies with software or digital services, including EdTech platforms. A tender, a contract security clause or a customer’s request may prompt a penetration test.
- Citizen portals and online forms
- Identity integrations for service sign-in
- Public digital service APIs
Healthcare penetration testing
A hospital’s or health insurer’s security checklist may lead your health-tech company to arrange testing. A hospital or another healthcare customer may also request a test of your platform.
- Patient portals and telemedicine apps
- FHIR and HL7 APIs
- Patient and clinician mobile apps
Logistics penetration testing
An enterprise customer’s API integration may prompt a test of your logistics, transport, fleet or connected-device platform. Other reasons include internet-facing partner APIs or an enterprise operator’s request.
- Fleet and telematics APIs
- Partner portals and web dashboards
- Mobile operator apps
How an engagement works
Scope and testing type
Every test starts with planning: we agree the scope, the systems to test and the rules that avoid disruption.We scope each test with you, either through our scoping questionnaire or in a scoping meeting where we ask the same questions.
Testing can be black-box, grey-box or white-box, agreed at scoping. White-box testing means full access to systems and documentation.
Environment and scheduling
We test on live systems and on staging environments. Roughly 70% of our tests run on live systems and 30% on staging.Testing is conducted under controlled conditions with agreed rules of engagement. We schedule around your business needs.
Report and language
Every report lists the vulnerabilities found, rates each by risk, and gives remediation steps. A penetration test report also sets out the exploitation methods demonstrated during testing, and a priority-based action plan.Our reports include an executive summary, the scope of work, the test type and methods, the methodology, how risk is calculated, a summary of findings, detailed results for each finding, and a conclusion.
Reports run to 20–100+ pages.
We deliver the report in the language you ask for: English, Estonian or another language, or more than one.
Retesting and support
After you fix the findings, we re-test them.A retest covers the findings only, not the full application. It is usually quoted in the same offer as the test. The retest window is about 4 weeks, or sooner if you have fixed the findings earlier and our schedule has an opening.
After the report, we hold a consultation on the findings and help you verify fixes.
Common questions about testing
How much does penetration testing or a vulnerability assessment cost?
Penetration testing and vulnerability assessment are priced per project, based on what is in scope.
Penetration testing cost factors
- Number of systems or applications in scope
- Testing type
- Complexity of the environment
- Timeline
Vulnerability assessment cost factors
- Number of systems or applications in scope
- Size and complexity of the environment
- Depth of the report
How long does testing take?
Testing takes from a few days to a few weeks, depending on the project. The average testing period is 1–2 weeks.
How soon can you start testing?
When testing can start depends on our current schedule. If you need it sooner, contact us and we will do our best to accommodate you.
How often should we arrange penetration testing?
We recommend penetration testing 2–4 times a year, and after major changes.
Can we see a sample penetration test report?
You can request our sample web application penetration test report through the contact form or by email.
Does GDPR require a penetration test?
Among the security measures GDPR Article 32(1) expects controllers and processors to implement where appropriate is a process for regularly testing, assessing and evaluating their effectiveness (point (d); the UK GDPR has the same text). A penetration test is one way to evidence that process for the systems it covers.
Experience and method
With over 7 years of experience in testing, we have built extensive expertise in web applications and websites, e-commerce platforms, mobile applications, APIs and SaaS solutions.
Our penetration tests can follow OWASP, ISSAF, PTES or OSSTMM at your request or on our recommendation. What we follow and how much of it we cover are agreed at scoping.
Testing uses Burp Suite, manual testing and our own tools.
Our pentesters hold certificates including PNPT, eCPPTv2, CAP, CompTIA PenTest+ and CompTIA Security+, and their published research includes five CVEs.
Discuss your testing needs
We provide testing evidence. We do not audit or certify compliance with any regulation or standard.
You can request our sample web application penetration test report through the contact form or by email.
Or email us at info@c-yber.com
What to include
Describe what needs testing (web app, mobile app or API), the approximate scope, why and when you need the test, and whether you want the sample report.
What to leave out
Do not send passwords, API keys, tokens or other access details, source code, details of unfixed vulnerabilities, or your customers’ personal data.