Overview
Desktop applications are still common in UK finance, healthcare and manufacturing, and they are often older than the security controls around them. We test local storage, network traffic, update mechanisms and privilege boundaries.
Thick client applications — trading terminals, ERP clients, healthcare systems, point-of-sale and internal tools — often hold sensitive data and talk directly to databases or backend services. Because they run on the user's machine, attackers can inspect, modify and replay everything the client does.
Our testers analyse the application binary and its local files, intercept and manipulate traffic (including non-HTTP protocols), inspect memory for secrets, test for DLL hijacking and insecure update mechanisms, and attack the backend services the client depends on.
The most serious issues are usually trust problems: business rules enforced only in the client, credentials or connection strings stored locally, and servers that accept whatever the client sends.
How testing works for UK organisations
- Signed scope and written authorisation before any testing, in line with the Computer Misuse Act 1990
- Testing windows agreed in UK time, including out-of-hours windows for production systems
- Fully remote delivery, with internal and wireless access via VPN or a posted test device, so there are no travel costs
- Reports mapped to ISO 27001, PCI DSS, UK GDPR Article 32 and customer questionnaires, with a fixed price in GBP
What's included
Our approach
- UnderstandArchitecture, roles and backend dependencies.
- AnalyseStatic and dynamic analysis of the client.
- InterceptTraffic interception and manipulation.
- Attack backendTest servers and databases the client uses.
- Report & retestFindings with fixes for client and server teams.
What you receive
- Client and server findings
- Proof-of-concept evidence
- Architecture-level recommendations
- Retest report
- Attestation letter
Standards & frameworks
- OWASP Desktop App Security Top 10
- OWASP ASVS
- CWE
- PTES
- NCSC penetration testing guidance
Frequently asked questions
What is a thick client?
A desktop application that performs significant processing locally and communicates with backend servers, as opposed to a browser-based thin client.
Do you need a test environment?
Yes, ideally a test instance of the client and backend with test accounts for each role.
Can you test proprietary protocols?
Yes. We analyse and manipulate non-HTTP traffic where needed.
Are you CREST or CHECK accredited?
We don't claim CREST or NCSC CHECK status on this site. Most private-sector tests, including those for ISO 27001, PCI DSS and customer due diligence, don't require either. If a contract, public-sector buyer or regulator specifically requires a CHECK or CREST-accredited provider, tell us at scoping and we'll tell you honestly whether we can meet it. See our CREST and CHECK guide.
Do you quote in pounds sterling?
Yes. UK proposals are fixed-price and quoted in GBP. Prices exclude VAT where VAT applies to cross-border services. We confirm the treatment for your organisation in the proposal.