Web Application Penetration Test
What scanners miss on a web application. Users reaching data that is not theirs, and workflows that can be abused.
Book a Scoping CallWe find what scanners miss: users reaching data that is not theirs, workflows that can be abused and minor weaknesses that combine into serious ones. You get evidence your engineers can act on and a summary your customers, investors or auditors will accept.
Who it is for
- Teams launching a customer-facing application or major release.
- Organisations answering a customer security questionnaire, due diligence or supply-chain requirement.
- Security and compliance leads commissioning an annual application test.
Scope bands
Fixed scope, fixed fee. Answer four questions, receive a fixed-fee quote, and nothing changes once work starts. Larger or more complex requirements are scoped as a Bespoke engagement, still at a fixed fee agreed before work begins.
| Question | Focused | Core | Extended |
|---|---|---|---|
| How many environments need testing? | 1 | 1 | 2 |
| How many different user types log in? (e.g. customer, staff, admin) | Up to 2 | Up to 4 | Up to 6 |
| How many main sections are in the navigation menu? | Up to 10 | Up to 20 | Up to 35 |
| Do separate customer organisations share the app and must not see each other’s data? | No | No | Yes |
Environments
- Focused
- 1
- Core
- 1
- Extended
- 2
User types
- Focused
- Up to 2
- Core
- Up to 4
- Extended
- Up to 6
Navigation sections
- Focused
- Up to 10
- Core
- Up to 20
- Extended
- Up to 35
Shared tenancy
- Focused
- No
- Core
- No
- Extended
- Yes
Your highest answer sets the band. One answer in Extended places the engagement in Extended, whatever the other three are.
Bespoke
Separate APIs, multiple applications, payments beyond a standard checkout, or regulated data.
Included with every Enhanced package
- Full technical report: every finding with severity, business impact, evidence and remediation guidance.
- Letter of attestation: a forwardable summary for the customer, insurer, investor or auditor who asked for the test.
- 60-minute debrief for technical and business stakeholders.
- One retest within 30 days, with a retest report.
- Immediate escalation of any critical issue found during testing, not held until the report.
- Independent quality review of every report by a second senior practitioner before issue.
How it works
- 01Answer the four scoping questions.
- 02Receive a fixed-fee quote.
- 03Sign authorisation and set up access (some packages include an access guide).
- 04We test, issue the report within five business days, run the debrief and complete the retest.
Good to know
AI-assisted analysis is used only on sanitised data, and every finding is manually reproduced by a qualified tester.
Exploitability, not a scanner dump
- Every finding is reproduced by hand before it reaches the report. Anything a tester cannot reproduce is discarded rather than passed on with a caveat.
- Findings are rated by what an attacker could actually do with them in your environment, not by the raw score a tool assigned.
- Where a route exists from a starting foothold to something that matters, we show the route rather than listing the steps as separate findings.
- Every report is independently quality reviewed by a second senior practitioner before it is issued.
Who tests
Testing is led by a UK Cyber Security Council Principal practitioner (Security Testing) holding CREST CRT, OSCP, OSEP and CyberScheme Team Leader. Every report is independently quality reviewed by a second senior practitioner before issue. Our founders bring over ten years each in UK defence and critical national infrastructure. Tarian Labs is Cyber Essentials certified and based in South Wales.
Fixed scope, fixed fee, agreed before work starts.
A short call with a practitioner is enough to size this accurately.
Book a Scoping Call