1. Scope and authorization
We define in writing the domains, subdomains, applications, time windows and test limits. We do not start without a signed authorization. Output: a signed scope document.
Web penetration test · From €490, VAT excluded
External web penetration test, with manual validation and a signed attestation
A web penetration test checks websites and applications with the method of an authorized attacker. You receive what was tested, what is really exploitable, the order in which to fix it, and a signed letter of attestation to attach to tenders, client files or audits.
What a web penetration test is
A penetration test is an authorized, controlled security test. It does not stop at listing possible problems: it tries to exploit them within agreed limits, to show what damage they would really cause.
Our method follows the main reference guidelines: the OWASP Web Security Testing Guide (WSTG), PTES and NIST SP 800-115. The risk categories we check follow the OWASP Top 10, the list of the most common web vulnerability classes.
A penetration test is not a security certification and does not guarantee the absence of vulnerabilities. It shows, for the perimeter tested and at the time of the test, which weaknesses are exploitable and how to fix them.
How a web penetration test runs: five phases
Each phase has a concrete output. The perimeter and the rules are written before we start and stay valid for the whole engagement.
2. Reconnaissance
We map the exposed surface: hosts, services, technologies, endpoints, forms, login flows and the private area. Output: a map of the perimeter and its components.
3. Application testing
We verify authentication, session management, access control between users, input validation, configuration and business logic. Output: a list of confirmed or to-be-verified signals.
4. Manual validation
Every relevant signal is reproduced by hand. If a weakness is not exploitable in the real context, we document it as such and do not highlight it. Output: confirmed vulnerabilities, each with reproduction proof.
5. Report, debrief and retest
We deliver the report within 5 working days of signature, with a technical debrief with your team. After the fixes we retest the closed vulnerabilities, free of charge within 30 days.
What the client receives, point by point
The report is written for two readers: the people who build the product and the people who decide. The two parts do not overlap.
Executive summary
Two or three pages readable without technical jargon: what was tested, the overall risk level and the decisions management has to take.
Technical detail for each vulnerability
For each issue: description, the component involved, severity, reproduction steps, proof of impact and specific fix guidance.
Remediation plan
Fixes ordered by priority and estimated effort, in an order the team can follow without rebuilding it.
Signed attestation and retest
The letter states what was verified, when, with which method and with which outcome. The retest documents which vulnerabilities are now closed.
Who needs a web penetration test
A test is needed when someone outside the technical team must be able to trust what is online.
E-commerce and checkout
Sites that take orders and payments, where an authorization or validation error exposes customers and transactions. It is often the first step toward PCI DSS compliance.
Software houses and agencies
Teams that deliver applications to clients and receive security requests from their clients' customers. The report becomes part of the delivery.
SMEs answering a tender
Specifications that ask for a documented security verification as a requirement. The signed letter is often the proof requested.
Suppliers of regulated entities
Companies that must answer security questionnaires on NIS2 or GDPR on behalf of their clients. The penetration test is one of the technical evidence requested.
Penetration test or automated scanner: what changes in practice
An automated scanner is useful for a quick and frequent check. A penetration test answers a different question: which of those signals can an attacker actually use, and with what impact.
A typical example is missing access control between users. A scanner may not flag it, because the request is formally correct. A tester who changes an identifier and sees another account's data finds it in minutes, and can document it with a reproducible proof.
Common mistakes that make a penetration test useless
These are the problems we see most often, and they are avoided with a little preparation.
Testing without a written scope
A test on systems that were not declared can break the law and produces no usable evidence. The scope must be signed first.
Treating it as a certification
The test says what is exploitable at the moment it runs. After significant changes it has to be repeated.
Receiving a list without proof
A report without reproduction steps forces the team to rebuild everything. Always ask for reproducible evidence.
Fixing without retesting
An untested fix can be incomplete. The retest closes the cycle and proves it.
What you need to get started
A minimal preparation, usually completed in a few days.
- A list of the domains and applications to test, indicating those you own or are authorized to test.
- A technical contact available to answer questions during the test.
- If the application requires login, two test accounts with different roles, or an agreed access method.
- A time window for the test, especially if the site has traffic peaks or payment flows.
- The signed authorization and rules of engagement, before the start.
Price: what is included and what is not
The Single perimeter plan costs €490 one-off, VAT excluded. The price is clear, and the limits are written down.
| Included in the single perimeter | Not included (quoted on request) |
|---|---|
| One primary domain with its subdomains | Multiple domains or separate perimeters |
| Manual validation of findings | Internal testing and segmentation checks |
| Executive and technical report | Native mobile applications |
| Signed letter of attestation | Remediation support on your own code |
| Free retest within 30 days | Scheduled verifications (from 3 cycles) |
The full price list is on the home page. For scheduled verifications and extended perimeters, write to us with the detail of what you want to cover.
Frequently asked questions on web penetration testing
What is the difference between a penetration test and a vulnerability assessment?
A vulnerability assessment identifies and classifies vulnerabilities with a broad check. A penetration test goes further: it tests exploitation in a controlled way to show the real impact. Our service combines both levels in the same report.
Do I need a penetration test for a tender?
Many specifications and security questionnaires ask for a documented verification. We help you decide whether your case requires it and which perimeter best covers the request.
Can the test cause service disruption?
We work within scope limits agreed in writing and run controlled tests, with no destructive attacks and no denial-of-service. Before starting we define methods and windows, so the impact on the service is kept to a minimum.
How long does it take to get the report?
We deliver the report within 5 working days of the signed authorization. The free retest is included within 30 days of delivery.
How often should it be repeated?
At least once a year and after major changes: a new application version, an infrastructure change, a new login or payment system. For perimeters that change often we recommend scheduled verifications every 4 or 6 months.
Does the test require access to our internal systems?
No. The single-perimeter web penetration test is external: it works on public domains and applications. Internal tests, with network access, are a separate service quoted on request.
What happens if we find a critical vulnerability during the test?
We report it straight away, without waiting for the final report, with guidance on how to limit the risk in the meantime. The full detail arrives later in the report.
Are the report and the letter accepted by clients and auditors?
It is a documented and signed technical evidence. It does not replace a certification, but it answers the information clients, bodies and auditors usually ask for: what was tested, when, with which method and with which outcome.
Not sure whether your perimeter needs a penetration test?
Send us one domain: within 24 hours we tell you in writing whether the €490 verification fits, on which perimeter and what we would look at. No access to your systems.
Read your perimeter for free