Services

VAPT

A comprehensive testing approach that identifies vulnerabilities and actively exploits them to assess real security posture.

Capabilities

VAPT across your estate

Testing covers web and mobile applications, APIs, networks, thick clients, Active Directory, cloud platforms and OT environments. Findings arrive with proof, business impact and a remediation path, not just a scanner list.

Free toolkit

Penetration Testing Checklists

Sixteen assessment checklists covering the targets we test: web applications, Android, iOS, APIs, networks, Active Directory, thick clients, WiFi, SCADA and ATMs — plus red team test cases, firewall audit, malware analysis and vendor security assessment.

16 checklists · ZIP · 775 KB

Download the toolkit

Web Application
Authenticated, multi-role testing of web applications against OWASP ASVS and the Top 10, focused on business logic and authorisation rather than scanner output.
Methodology and deliverables
Android
Static, dynamic and runtime testing of Android applications against OWASP MASVS, including the parts of the attack surface that only exist on a device you do not control.
Methodology and deliverables
iOS
Static, dynamic and runtime testing of iOS applications against OWASP MASVS, on jailbroken and stock devices, including the Keychain and App Transport Security behaviour that only appears on real hardware.
Methodology and deliverables
API
Testing REST, GraphQL and SOAP interfaces against the OWASP API Security Top 10, with authorisation and object-level access control as the primary focus.
Methodology and deliverables
Network
Internal and external network penetration testing against NIST SP 800-115 and PTES, from perimeter enumeration through to lateral movement and domain compromise.
Methodology and deliverables
Active Directory
Attack path assessment of on-premises and hybrid Active Directory, from a standard user account to domain compromise, with every path mapped rather than only the first one found.
Methodology and deliverables
Cloud
Assessment of AWS, Azure and Google Cloud environments against CIS Benchmarks and the provider's own security reference, focused on identity, privilege escalation paths and exposed data.
Methodology and deliverables
Thick Client
Testing of desktop applications — .NET, Java and native Windows — covering the binary, local storage, inter-process communication and the backend the client talks to.
Methodology and deliverables
OT / ICS
Passive-first assessment of operational technology and industrial control systems against IEC 62443 and the Purdue model, where availability outranks confidentiality and a scan can stop a production line.
Methodology and deliverables

VAPT

Free toolkit

Web Application

Android

iOS

API

Network

Active Directory

Cloud

Thick Client

OT / ICS