PLEN
Book a call
All services
Cybersecurity

Cybersecurity services

We assess infrastructure vulnerabilities and test web applications, APIs and mobile apps. We follow OWASP methodologies. Every result is checked by hand, rated for risk and comes with a way to fix it.

Request a quoteBook a call

What the services cover

Vulnerability assessment

A broad review of infrastructure and applications for known vulnerabilities. Tools find candidates and we check every result by hand, so the report contains only real problems.

  • Internet-facing addresses and services, and the internal network.
  • Authenticated and unauthenticated scanning, when you want to see missing patches on servers.
  • Manual verification of every result and removal of false positives.
  • Rating based on CVSS 4.0, active exploitation and how critical the system is.
  • A one-off or recurring assessment, for example quarterly, compared with the previous result.
Request a quote for this service

Web application test

A test of the application and admin panel based on OWASP WSTG, with OWASP ASVS requirements. We test with accounts for every user role, because the most serious flaws hide behind the login.

  • Sign-in, sessions, password reset and multi-factor authentication.
  • Authorization: access to other users’ data (IDOR) and to other roles’ functions.
  • Injections: SQL, OS commands, XSS, SSRF and others.
  • Business logic: bypassing process steps, payments and limits.
  • File uploads, server configuration and security headers.
  • Data exposure in error messages, files and page source.
Request a quote for this service

API test

Tests of REST, GraphQL and SOAP interfaces based on the OWASP API Security Top 10. We test the interface directly, bypassing the application that normally uses it.

  • Object-level and function-level authorization, including access to other users’ records.
  • Authentication and token and key handling.
  • Excessive data in responses and mass assignment.
  • Rate limits and resistance to abuse.
  • Forgotten and old interface versions.
Request a quote for this service

Mobile application test

Tests of iOS and Android apps based on OWASP MASVS and MASTG, together with the server the app connects to.

  • Data storage on the device and in phone backups.
  • Communication with the server: encryption and certificate pinning.
  • Sign-in, sessions and server-side authorization.
  • Keys and secrets embedded in the app code.
  • Resistance to tampering and behaviour on rooted or jailbroken phones.
Request a quote for this service

Methodologies and standards

Tests follow public methodologies, so you know exactly what was checked. You choose the model: no prior knowledge (black box), with accounts and basic documentation (grey box) or with full access to documentation and code (white box). We usually recommend grey box, because it covers the most in the same time.

  • OWASP WSTG
  • OWASP ASVS
  • OWASP API Security Top 10
  • OWASP MASVS
  • OWASP MASTG
  • CVSS 4.0
  • CWE

How we work

1

Scope and rules

We agree in writing the targets, addresses, test accounts, time window and contacts. We sign a confidentiality undertaking.

2

Reconnaissance

We map the application or infrastructure: functions, roles, interfaces, technologies and entry points.

3

Testing

We combine tools with manual work. We report a critical vulnerability straight away, without waiting for the report.

4

Report and walkthrough

We hand over the report, walk the technical team through it and present the summary to management.

5

Retest

Once fixes are in place we check them again and confirm which vulnerabilities are resolved. The scope is agreed in the quote.

What you get

  • A technical report with vulnerabilities ranked by risk.
  • A plain-language summary for management.
  • A walkthrough of the results with the technical team.
  • Confirmation of fixed vulnerabilities after the retest.

What the report contains

  • Scope, methodology, test model and dates.
  • For every vulnerability: description, location, steps to reproduce and evidence as screenshots or requests.
  • CVSS 4.0 score and references to OWASP and CWE.
  • Business impact and a recommended fix with a suggested deadline.
  • Root causes of recurring flaws, so they do not come back in later releases.

What we need from you

  • A list of addresses, applications or interfaces in scope.
  • Test accounts for every user role.
  • Interface documentation, for example an OpenAPI file or a request collection.
  • A test window and a contact person on your side.
  • The hosting or cloud provider’s consent, where its rules require it.

Questions and answers

How does a vulnerability assessment differ from a penetration test?

A vulnerability assessment looks broadly for known flaws and ranks them by risk. A penetration test goes deep: it checks whether flaws can be exploited and chained, and what an attacker would achieve in practice.

Can testing disrupt our systems?

The risk is small and we limit it in the test rules: a time window, no load testing and constant contact with your team.

Do you test in production?

Ideally on a test environment that mirrors production. If there is only production, we agree extra limits, for example no operations that change data.

How often should we test?

After every major change to the application or infrastructure and at least once a year. NIS2 requires an assessment of how effective the security measures are, and regular testing is the simplest evidence of it.

Let’s start with the scope

Fill in a short scoping survey. We will prepare a quote with timing and delivery approach. Your data is protected by a confidentiality undertaking.

Request a quoteBook a call

Other services

vCISO: implementation and certification supportPenetration testing and auditsAll services