What the engagement covers
A single VAPT engagement combines automated discovery with deep manual exploitation. Scanners give coverage; our testers give context — chaining medium-severity issues into the kind of full compromise that scanners never report.
- External network testing — internet-facing infrastructure, VPN endpoints, mail and remote access.
- Internal network testing — assumed-breach simulation, lateral movement, privilege escalation and domain takeover paths.
- Web application testing — OWASP Top 10 plus business-logic abuse, authentication and authorisation flaws.
- API security testing — REST and GraphQL, broken object-level authorisation, mass assignment and rate-limit abuse.
- Mobile application testing — Android and iOS, local storage, certificate pinning and backend exposure.
- Cloud and Kubernetes review — IAM misconfiguration, exposed control planes, insecure workloads and secrets handling.
Our methodology
Testing follows recognised industry frameworks — PTES, OWASP WSTG/MASTG, NIST SP 800-115 and MITRE ATT&CK — so findings map cleanly onto whatever standard your auditors, board or regulator use.
- Scoping and rules of engagement — targets, testing windows, escalation contacts and safety limits agreed in writing.
- Reconnaissance and enumeration — attack surface mapping, service and version discovery, credential exposure checks.
- Vulnerability analysis — validated manually to remove the false positives that make scanner output useless.
- Exploitation and post-exploitation — controlled proof of impact, never destructive, always logged.
- Reporting — executive summary for leadership, technical detail with reproduction steps for engineers, CVSS ratings ordered by real business impact.
- Remediation support and free retesting of fixed findings so you can evidence closure.
What you receive
Every engagement ends with a report your team can hand straight to auditors and developers, plus a debrief session with the testers who did the work.
- Executive summary written for non-technical stakeholders and risk committees.
- Detailed technical findings with evidence, reproduction steps and remediation guidance.
- Risk-ranked remediation roadmap covering quick wins and structural fixes.
- Retest report confirming each closed finding — useful evidence for compliance and customer due diligence.
- A letter of attestation you can share with clients, partners and insurers.
Who this is for
Banks, fintechs, SACCOs, insurers, telcos, healthcare providers, government agencies and SaaS companies that either hold sensitive data or must demonstrate independent testing to a regulator, customer or certification body. If you handle payments, personal data or critical infrastructure, annual testing is the baseline — and testing after every significant change is the standard we recommend.
Frequently asked questions
How long does a test take?
Most single-application or small-network tests run 5–10 working days including reporting. Larger, multi-environment engagements are scoped individually after a short discovery call.
Will testing disrupt production?
No. Denial-of-service and destructive techniques are excluded by default, testing windows are agreed up front, and we maintain a live escalation channel throughout the engagement.
What is the difference between VAPT and a vulnerability scan?
A scan lists potential issues from a signature database. VAPT validates them by hand, chains them together, and demonstrates the actual business impact of a successful attack.
Do you retest after we fix findings?
Yes — retesting of remediated findings is included, and you receive an updated report reflecting the closed items.
