Web application penetration testing that finds what scanners miss.
Manual, senior-led web application penetration testing focused on access control, business logic and the attack paths that lead to real impact — not a reformatted scanner report.
The most serious web vulnerabilities are invisible to automated scanners.
Scanners are good at known, generic issues. They are poor at understanding what your application is supposed to do — so they miss the flaws that matter most: one customer reading another’s data, a user granting themselves admin rights, a payment step that can be skipped.
Our web application penetration tests are manual and authenticated, with a test account for every user role. We think like an attacker who wants something specific from your application, and show you exactly how they could get it.
Every layer of your application.
Testing follows the OWASP Web Security Testing Guide, adapted to how your application actually works.
Authentication
Login, MFA, password reset and account recovery — and how they can be bypassed or abused.
Authorisation & access control
Horizontal and vertical privilege escalation, IDOR and cross-tenant data access across every role.
Business logic
Workflows, approvals, payments and limits — tested for skipped steps, replays and race conditions.
Session management
Tokens, cookies, timeouts and session fixation or hijacking.
Input handling & injection
SQL and NoSQL injection, XSS, SSRF, template injection and file upload abuse.
Sensitive data exposure
Data leaking through responses, errors, caching, exports and client-side code.
Underlying APIs
The APIs behind your front end, which often expose more than the interface does.
Configuration
Security headers, TLS, CORS, framework and server configuration.
AI features
Chatbots and AI features embedded in your application — see AI security testing.
How we test.
AI-assisted speed for the repetitive work. Senior, manual testing for judgement, exploitation and evidence.
Scope
Agree URLs, environments, user roles and test accounts.
Map
Explore the application and understand its logic and data.
Test
Manual testing of every role, supported by efficient tooling.
Exploit & verify
Confirm impact safely and remove false positives.
Report & retest
Clear findings, fix priorities and revalidation.
Choose the right starting point.
Authenticated (grey box)
Test accounts for each role — our recommended approach, as most serious issues sit behind the login.
Unauthenticated (black box)
What an anonymous attacker can see and do, from the outside in.
White box
With source code or architecture access, for deeper coverage in less time.
Fixed price, agreed before testing starts.
Penetration tests are priced per consultant day at £795 + VAT per consultant day. You get a fixed price in a statement of work after a short scoping call — no hidden day rates.
Typically 3–6 days for a single application with two or three user roles. Larger or multi-application scopes are quoted individually.
- Senior, hands-on testing by the person who scopes it
- Live findings on the client platform
- Report with executive summary and remediation
- Retest terms agreed up front
Evidence you can act on — and share.
Executive summary
Plain-English risk, business impact and priorities for leadership and boards.
Attack paths
How individual weaknesses chain together into real-world impact.
Technical findings
Evidence, CVSS scoring and specific, practical remediation for every finding.
Live findings
Findings published to the SMARTSEC client platform as the engagement runs.
Retest
Independent revalidation of fixes, with retest terms agreed in the statement of work.
Debrief
A walkthrough of the results with your technical team and stakeholders.
What we typically find.
Examples of the issue types this kind of test regularly uncovers — illustrative, not client data.
- Insecure direct object references exposing other users’ data
- Missing function-level access control on admin actions
- Business logic flaws in payments, approvals or limits
- Account takeover through password reset or recovery flaws
- Stored and reflected cross-site scripting
- Server-side request forgery to internal services
- Sensitive data in API responses not shown in the interface
- Weak session handling and token management
Evidence for the people who ask.
- Client and partner due diligence — independent evidence for security questionnaires, banking partners and enterprise clients.
- PCI DSS — Requirement 11.4 expects penetration testing at least annually and after significant change.
- ISO 27001 — supports management of technical vulnerabilities and secure development controls.
- DORA and FCA operational resilience — evidence that client-facing services resist realistic attacks.
Web application questions.
What is web application penetration testing?
A manual security assessment of a web application, simulating how an attacker would try to bypass authentication, access other users’ data, abuse business logic or compromise the underlying systems — with every finding verified and explained.
How long does a web application penetration test take?
Typically 3–6 days for a single application with two or three user roles. Complex applications, many roles or multiple applications take longer.
Do you test authenticated?
Yes, and we recommend it. Most serious issues sit behind the login, so we test with an account for each user role.
Can you test our production environment?
Yes. Testing is agreed in advance, limited to the approved scope and window, and anything potentially disruptive needs explicit approval. Where a staging environment mirrors production, we can test there instead.
Is this different from a vulnerability scan?
Yes. Scans find known issues automatically. A penetration test adds manual testing of logic and access control, removes false positives and shows how issues chain together into real impact.
Is a retest included?
Retest terms are agreed in the statement of work, so you can evidence that issues have been fixed.
Need a web application tested?
Tell us about your application, its users and your deadline — we’ll confirm scope and a fixed price.