Penetration Testing

Web Application, API & Network Penetration Testing

Find the weaknesses an attacker could use to access data, abuse business logic or move through your systems. We perform manual penetration testing of applications, APIs and networks, with clear findings your engineers can act on.

Testing is scoped to the systems you need assessed. Application testing, API testing and internal or external network testing can be commissioned individually or combined where appropriate.

Request a PentestSee What We Test
Application testing boundaries
Browser
API
Application
Database
AuthenticationPermissionsBusiness logic

Test the boundaries your software depends on

Can a user access another customer’s records? Can a restricted account perform an administrative action? Can a valid sequence of requests be rearranged to bypass a business rule?

These questions require an understanding of how your product is supposed to work. Our assessments investigate the relationship between user roles, application behavior and the controls protecting sensitive data and functionality.

Trust boundaries
Identity
Allowed actions
Protected data

What we test

Web Application Penetration Testing

We assess websites, SaaS platforms, dashboards and backend functionality for weaknesses that could compromise users, data or business operations.

Depending on the agreed scope, testing covers:

  • Authentication flows and weaknesses that could allow unauthorized access.
  • Authorization between users, roles, tenants and administrative functions.
  • Business logic that can be manipulated through unexpected inputs or workflows.
  • Sensitive data exposed through application responses or functionality.
  • Other exploitable issues in the application’s security-relevant features.

For example, a user interface may hide an administrative control while the backend still accepts the action from an ordinary account. We investigate whether the underlying controls enforce the intended restrictions.

API Penetration Testing

An API must enforce access rules even when a request never passes through your application’s interface. We assess backend endpoints and the authorization boundaries around their data and actions.

Testing may examine whether a caller can access another user’s objects, read restricted fields, invoke privileged functions or misuse a sensitive business workflow. We also investigate authentication weaknesses and inappropriate data exposure within the agreed endpoints.

API documentation, example requests and test accounts can help define coverage. They are discussed during scoping; no particular access model is assumed.

External Network Penetration Testing

Assess the infrastructure an attacker can reach from outside your organization. We examine authorized public-facing hosts and services for exposed functionality, vulnerabilities and potential routes into connected systems.

The objective is to understand what an external attacker could exploit within the defined targets and testing boundaries.

Internal Network Penetration Testing

Assess what could happen from an agreed position inside your environment. We investigate reachable services, network weaknesses, privilege escalation and potential lateral movement between systems.

The starting access matters. Testing from a limited user account answers different questions from testing with broader access. We agree the starting point and permitted activities before the engagement.

Built for product, engineering and security teams

This service fits SaaS businesses, software teams and organizations with specific systems they need independently tested.

Consider an assessment when you are:

  • Preparing to launch an application or deploy it to a major customer.
  • Releasing an API or changing authentication, permissions or tenant isolation.
  • Introducing a sensitive workflow such as account administration or data sharing.
  • Responding to a customer request for independent security testing.
  • Reviewing infrastructure after significant network changes.

The trigger helps define the scope. An API release does not automatically require an internal network test.

How the engagement works

1. Agree the targets and rules

We define the assets, objectives, access level, environment, testing window and permitted activities. We also agree how to communicate significant findings during the work.

2. Understand the application or environment

We examine the available documentation and system behavior to identify important roles, entry points, data flows and trust boundaries.

3. Investigate and validate weaknesses

Manual testing follows the ways the system could be misused. Supporting tools can help with discovery, but findings are assessed in the context of the target and the evidence available. Validation stays within the agreed testing boundaries.

4. Report the impact and remediation

We explain what was found, the conditions needed to exploit it and the changes recommended to address it. The report records the scope and limitations so your team can interpret the results accurately.

Source review where it adds depth

Black-box testing examines the behavior exposed by a running system. When included in scope, source code review can help trace authorization decisions, investigate backend logic and understand why a weakness exists.

We can combine these approaches where appropriate. Source access, authenticated testing and internal network access are not automatically included in every engagement; each is agreed during scoping.

Source & runtime review
Source code
Application logic
Runtime behavior

Findings your engineers can work with

Your report includes:

  • An executive summary of the most significant findings.
  • The systems and testing areas covered, with relevant access assumptions and limitations.
  • Technical findings, supporting evidence and reproduction details where appropriate.
  • Severity and potential business impact, including exploitation conditions.
  • Recommended remediation and priorities for addressing the findings.

If you need fix verification, a report format for a customer review or additional testing after changes, raise that during scoping so it can be included in the proposal where agreed.

Why CD Security

OSCP-certified researchers with 10+ years of Web2 security experience

Our Web2 team brings more than a decade of offensive security experience across penetration testing, red teaming, exploit development and fuzzing. Our researchers hold OSCP, earned through a demanding practical exam involving nearly 24 hours of hands-on testing, followed by a detailed technical report. Candidates must demonstrate that they can exploit vulnerabilities, escalate privileges and document their findings.

Expert-led testing, reinforced by AI-assisted analysis

Our researchers lead every assessment, investigating your application’s logic, access controls and potential attack paths. AI-assisted analysis adds a second layer of review to help surface overlooked weaknesses and challenge assumptions. Our researchers validate findings and assess their real-world impact before reporting them.

Clear guidance to fix vulnerabilities

You receive findings with supporting evidence, reproduction steps and an explanation of the potential business impact. We prioritize the issues and provide specific remediation guidance so your engineers understand what needs to change, why it matters and what to fix first.

Define your next penetration test

Tell us which application, API or network you want tested, what has changed and when you need the assessment. We will use that information to define the scope and quote.

Request a Pentest

Frequently asked questions

Does a penetration test include applications, APIs and networks?

Only the areas agreed in scope. You can request a web application or API assessment without buying network testing. We can also scope internal or external network testing as a standalone engagement.

How does this differ from a vulnerability scan?

A scan can identify known patterns and exposed services. A penetration test also investigates how the system behaves, whether access controls hold and whether individual weaknesses can be exploited in context. Manual review is particularly useful for authorization and business logic that depend on your product’s intended behavior.

Do you need source code or user accounts?

Not for every engagement. Black-box testing can start without source access. Authenticated testing requires suitable accounts, and source-assisted testing requires the agreed code. We explain the coverage and limitations of the chosen access model before testing.

Can you test a production system?

The environment and testing constraints must be agreed first. Production testing can affect availability or data, so we define permitted activities and coordination arrangements during scoping. We do not promise risk-free production testing.

Do you cover OWASP risks?

Our application and API capabilities include authentication, access control, data exposure and business logic weaknesses addressed by OWASP guidance. If you need coverage mapped to the OWASP Web Security Testing Guide or API Security Top 10, tell us during scoping so the relevant checks and reporting requirements can be agreed.

How long does a penetration test take, and what does it cost?

That depends on the number and complexity of targets, user roles, access available and testing depth. We provide an engagement-specific scope, timeline and quote after reviewing your requirements.

Is retesting included?

Retesting terms are defined in the proposal. If you need confirmation that fixes address the findings, include that requirement when requesting the assessment.