Choosing a web application penetration testing company is harder than it looks. A polished pitch is easy to produce, and it does not tell you much about the quality of the testing you will actually receive. A short conversation with the people who will do the work tells you more than any brochure.
Talk to a tester, not only a salesperson
Ask to speak with a hands-on tester before you sign. Reputation and real experience are what drive quality on an engagement, so it is reasonable to want to understand who is doing the work and how they approach it.
Questions that reveal depth
You do not need to be an expert to gauge one. A few focused questions usually show how deep a team's knowledge goes:
- How do you test for injection issues, including server-side and template injection, and how often do you find them?
- How do you approach XML External Entity (XXE) issues, and what impact can they have?
- How do you test access control and multi-tenant separation between users and roles?
- How do you find business logic flaws that scanners miss?
- What does your report include, and do you walk through the findings afterward?
Clear, specific answers are a good sign. Vague ones are worth noting.
How we work
Our web application testing is manual first, supported by tooling, and performed by consultants who hold both the GWAPT and OSWE certifications. Every tester has at least five years of experience, and all testing is performed in the United States. You can read more on our web application security testing page.
Have a system you want tested?
Tell us what you are working with and we will follow up with next steps.