How long does a web application penetration test take?
Standard engagements run 5-10 working days for active testing, plus 3-5 days reporting and a free retest after remediation. Smaller scopes complete in 5-7 days end-to-end. Complex multi-tenant or integration-heavy applications run 3-4 weeks.
How much does web application penetration testing cost in the UK?
Indicative ranges: small SMB applications £5,000-£8,000, standard SaaS / business apps £8,000-£18,000, enterprise / multi-tenant £18,000-£35,000. Pricing depends on user-role count, business-logic complexity, and integration surface.
What methodology do you follow?
CREST-aligned methodology built on OWASP Web Security Testing Guide (WSTG), OWASP ASVS, NIST SP 800-115, and PTES. Reports map findings to all four standards plus your specific compliance regime.
Do you test in production or a non-production environment?
Most engagements run against UAT or staging. Production testing is supported with explicit firm-side approval, restricted scope, real-time SOC coordination, and incident-response liaison.
What’s the difference between a vulnerability scan and a penetration test?
Vulnerability scans are automated and catch known patterns. Penetration tests are performed by humans and catch business-logic flaws, IDOR, broken authorisation, and chained vulnerabilities. ISO 27001 / SOC 2 / PCI DSS audits accept pen test evidence; scan-only evidence is generally insufficient.
Do you test single-page applications, GraphQL APIs, and modern frontends?
Yes. Our methodology covers React/Vue/Angular SPAs, GraphQL endpoints, WebSocket security, postMessage abuse, CSP bypass, and client-side route-guard bypass.
Can you map findings to our specific compliance framework?
Yes. Reports include explicit mappings to ISO 27001 Annex A.12.6.1, SOC 2 Trust Services Criteria, PCI DSS Requirement 11, FCA SYSC, UK GDPR Article 32, and Cyber Essentials Plus controls.
What’s in the report?
Executive summary (board-ready), technical report with CVSS 3.1 scores, reproduction steps, screenshots, specific remediation guidance, and a 60-minute walkthrough call. Letter of attestation issued after free retest.
Do you sign NDAs?
Yes. We sign client-supplied NDAs as standard. Engagement data is protected under our ISO 27001 (BSI-audited) information security management system.
Can you simulate threat actors targeting our sector?
Yes. For sector-specific engagements we model the actual threat actors active against your industry using TTPs from current threat intelligence.
How quickly can you start?
From signed scope to active testing in 24 hours where required. Standard pipeline is 3-5 business days from initial scoping call to test start.
Are your testers UK-based and what certifications do they hold?
Every engagement is performed by vetted UK or international pentesters matched to your engagement based on security clearance, compliance scope, and sector specialism. Testers hold CREST certifications relevant to their discipline (CRT, CCT APP, CCT INF, CCSAM).
