Overview
From fintech platforms regulated by the FCA to public-sector suppliers and e-commerce sites, UK web applications are judged on access control and data protection. We test every role and workflow by hand and explain the business impact in plain English.
Web applications are where your customers, your data and your revenue meet — and they are the most common entry point in real-world breaches. Our web application penetration tests go well beyond the OWASP Top 10 checklist to find the issues that actually lead to data exposure.
We test as every user role you have, and for SaaS platforms we test across tenants: can one customer read, modify or delete another customer's data? Can a standard user reach admin functions? Can a checkout, approval or refund workflow be manipulated? These questions require human understanding of how your application is supposed to work.
Testing follows the OWASP Web Security Testing Guide (WSTG), with findings mapped to the OWASP Top 10:2025 so they are easy to communicate to stakeholders and auditors.
How testing works for UK organisations
- Signed scope and written authorisation before any testing, in line with the Computer Misuse Act 1990
- Testing windows agreed in UK time, including out-of-hours windows for production systems
- Fully remote delivery, with internal and wireless access via VPN or a posted test device, so there are no travel costs
- Reports mapped to ISO 27001, PCI DSS, UK GDPR Article 32 and customer questionnaires, with a fixed price in GBP
What's included
Our approach
- Application walkthroughWe learn your roles, data model and critical workflows — ideally with a short call with a product owner.
- Mapping & discoveryWe crawl and proxy the application, identify hidden endpoints and enumerate parameters.
- Authenticated manual testingEach role is tested against every function and object, alongside targeted tooling.
- Exploit chainingLower-severity issues are combined to demonstrate realistic attack paths.
- Report, debrief & retestClear evidence and fixes for developers, followed by verification of remediation.
What you receive
- Findings mapped to OWASP Top 10:2025 and CWE
- HTTP request/response evidence for each issue
- Root-cause remediation guidance
- Role and tenant coverage matrix
- Retest report and attestation letter
Standards & frameworks
- OWASP WSTG
- OWASP Top 10:2025
- OWASP ASVS
- CWE
- PCI DSS 11.4
- SOC 2 CC4.1
- NCSC penetration testing guidance
Frequently asked questions
Grey-box or black-box — which is better?
Grey-box (with test accounts and some documentation) gives the deepest coverage for the budget and is what we recommend for most applications. Black-box is useful for simulating an external attacker against public functionality.
How do you price a web application test?
Effort is driven by the number of user roles, dynamic pages, API endpoints and complex workflows. We provide a fixed price after a short scoping call.
Can you test applications behind a WAF?
Yes. We can test with the WAF in place, allow-list our IPs for depth, or do both to evaluate the WAF's effectiveness.
Are you CREST or CHECK accredited?
We don't claim CREST or NCSC CHECK status on this site. Most private-sector tests, including those for ISO 27001, PCI DSS and customer due diligence, don't require either. If a contract, public-sector buyer or regulator specifically requires a CHECK or CREST-accredited provider, tell us at scoping and we'll tell you honestly whether we can meet it. See our CREST and CHECK guide.
Do you quote in pounds sterling?
Yes. UK proposals are fixed-price and quoted in GBP. Prices exclude VAT where VAT applies to cross-border services. We confirm the treatment for your organisation in the proposal.