Web Application Penetration Testing

Typically, we find that web application assessments take 2 – 6 weeks depending on complexity and feature set. 

You can expect to pay no less than $30,000 for an authenticated web application penetration test with us, though the scope of your assessment always determines the final price.

Sometimes called an instance, a tenant is a term used to describe a single customer’s environment within your application. Different applications will break down tenancy in different ways—yours may separate tenants into individual client organizations, and or perhaps different tenants are different teams that each contain individual users assigned within a team.

If that’s the case, to thoroughly test your application for business logic and authorization issues, we would need you to provision us two tenants—consider it like “onboarding” two new customers. Using these two separate roles, we’ll be able to tell you whether Tenant A can access data or make changes to Tenant B and ensure that these different areas/user accounts/tenants are each secure. 

Using these different accounts, we’re able to assess the security of the web application from different perspectives and identify potential vulnerabilities that may be present based on different levels of access and privilege.

By not allowing our public IP addresses past your technical security controls during a pen test, you will diminish the overall value gained from the engagement. Remember, a real-world attacker has unlimited time to bypass your controls, but the pen test will always be a timeboxed assessment—when a web application firewall (WAF) or other security controls are in place, they will prevent us from fully evaluating the web application and its supporting infrastructure.

Additionally, your compliance requirements may require you to disable these controls.