Audits and penetration tests
We test web apps, B2B panels, APIs and infrastructure against OWASP Top 10 and OWASP ASVS: authentication, authorisation, injection, configuration, headers, TLS and data exposure.
Fixes and hardening
Findings become concrete tasks: Laravel and PHP code fixes, dependency updates, Linux server configuration, backups, secrets handling and a safer deployment pipeline.
Monitoring and compliance
We set up recurring scans, alerts for new vulnerabilities and expiring certificates, and help prepare technical documentation for NIS2 and GDPR.
Who it is for
Companies running a web application, online store, B2B platform, customer portal or API with customer data that want to understand their real risk. Especially relevant for NIS2-regulated companies and suppliers whose clients ask for proof of security.
Rules of engagement
Every test runs only under written authorisation from the system owner, with an agreed scope (domains, IP addresses, environments), time window and contact person. We never run DoS-style load tests without separate consent, and results are covered by an NDA.
What you get
A report with an executive summary, a list of vulnerabilities with CVSS scores, reproduction steps and remediation guidance. After fixes are deployed we retest and confirm which issues are closed.
What a company should know before starting this service
Security does not start with buying a tool. It starts with knowing what the company protects: customer data, orders, panel access, sales continuity. In this service we first agree the scope and sign a test authorisation, then examine systems from the outside and inside, and finally deliver a report that translates into concrete tasks for the team.
How this service turns into a working business system
Scope and authorisation
We agree the goal, systems in scope, environment, time window and contacts, and sign the test authorisation, NDA and, if needed, a data processing agreement.
Reconnaissance and scanning
We map the attack surface: domains, subdomains, open ports, technologies, certificates, headers and known vulnerabilities in the software versions in use.
Manual testing and verification
We manually test business logic, permissions, sessions, forms and APIs, and verify every automated finding so the report contains no false alarms.
Report, fixes and retest
We deliver a prioritised report, help implement fixes in code and configuration, then retest and optionally set up continuous monitoring.
What should improve after implementation
- Clarity on which risks are real and which are theoretical
- Fewer internet-facing vulnerabilities and faster reaction to new ones
- Documentation that supports NIS2, GDPR and client security questionnaires
- A safer release and maintenance process for your applications
Frequently asked questions
Is a penetration test legal?
Yes, when it is performed with written consent from the system owner and within the agreed scope. That is why every engagement starts with an authorisation listing domains, IP addresses and test dates.
Can testing disrupt production?
The risk is low and controlled. We agree a time window, traffic limits and a contact person, never run DoS tests without separate consent, and use a staging copy of production where possible.
How long does an application security audit take?
A quick external review of a website or store usually takes 2–3 working days. A full test of a web application with an admin panel and API usually takes 5 to 15 days, depending on roles, modules and integrations.
Do you help with NIS2 readiness?
Yes, on the technical side: system inventory, vulnerability assessment, hardening, backups, monitoring and an incident handling procedure. For legal interpretation of obligations we work alongside the client legal or compliance advisor.
Do you fix the vulnerabilities you find?
Yes. That is our main difference from firms that only hand over a report. As a development team we patch Laravel and PHP code, update dependencies, configure servers, deploy fixes and then retest.
Do you offer continuous security monitoring?
Yes. After the audit we can set up recurring external scans and monitoring of SSL certificates, security headers and known vulnerabilities, with a monthly report and alerts on critical changes.