Skip to content

Services

Six ways in. One standard of evidence.

Every engagement is scoped with the engineer who tests it and quoted in writing from that scope. It ends with verified findings you can replay, remediation your developers can act on, and a retest once you fix them.

01

Web Application & API Pentesting

Surgical exploitation of web applications and their underlying APIs — REST, GraphQL, and SOAP — covering authentication bypasses, injection flaws, BOLA/IDOR, and business logic vulnerabilities in a single unified engagement.

Typical duration
2-4 Weeks
Scope this test Test plan

What we test

  • Authentication & Authorization
  • Injection Flaws
  • Business Logic
  • BOLA / IDOR
  • Mass Assignment
  • Rate Limiting

Who it is for

  • SaaS products and customer portals before a major release
  • Teams that need evidence for SOC 2, ISO 27001 or customer security reviews
  • Public or partner APIs with multiple roles and tenants

What you receive

  • Replayable request/response evidence per finding
  • Role and tenant authorization matrix coverage
  • Code-level remediation guidance
02

Mobile App Security

Deep-dive assessment of iOS and Android applications, covering local storage, IPC, and API communications.

Typical duration
3-5 Weeks
Scope this test Test plan

What we test

  • Jailbreak/Root Detection Bypass
  • Reverse Engineering
  • Insecure Storage
  • API Abuse

Who it is for

  • Consumer and fintech apps handling credentials or payments
  • Apps that rely on client-side controls such as root or jailbreak checks
  • Teams releasing a new mobile client against an existing API

What you receive

  • Static and dynamic analysis findings per platform
  • Evidence of API abuse from the mobile client
  • Platform-specific remediation steps
03

Thick Client Pentesting

Analysis of rich desktop applications, intercepting traffic, and analyzing local processing logic.

Typical duration
2-4 Weeks
Scope this test Test plan

What we test

  • Memory Corruption
  • Privilege Escalation
  • DLL Hijacking
  • Traffic Interception

Who it is for

  • Desktop software installed on customer or employee machines
  • Applications that store secrets or enforce licensing locally
  • Legacy clients talking to modern back-end services

What you receive

  • Local privilege and file-system findings
  • Intercepted protocol analysis
  • Hardening and remediation guidance
04

Network & Cloud Security Assessment

Unified external and internal network compromise simulation combined with deep cloud misconfiguration analysis across AWS, Azure, and GCP — covering the full attack surface from perimeter to cloud control plane.

Typical duration
3-6 Weeks
Scope this test Test plan

What we test

  • Active Directory Compromise
  • Lateral Movement
  • IAM Privilege Escalation
  • Storage Misconfigurations
  • Perimeter Breach
  • Serverless Vulnerabilities

Who it is for

  • Organisations with hybrid on-premises and cloud estates
  • Teams that want to know how far an initial foothold can go
  • Cloud accounts that grew faster than their IAM reviews

What you receive

  • Attack-path narrative from entry point to impact
  • IAM and configuration findings with evidence
  • Prioritised hardening plan
05

IoT / OT Security

Hardware hacking, firmware extraction, and protocol analysis for connected devices and industrial control systems.

Typical duration
4-8 Weeks
Scope this test Test plan

What we test

  • Firmware Analysis
  • Hardware Interfaces (UART/JTAG)
  • Radio Protocols (BLE/Zigbee)
  • ICS/SCADA Networks

Who it is for

  • Connected-device manufacturers before production runs
  • Operators of industrial or building-control networks
  • Products with companion apps and cloud back ends

What you receive

  • Firmware and hardware interface findings
  • Protocol-level evidence
  • Safety-aware remediation guidance
06

PTaaS

Ongoing penetration testing integrated into your SDLC, with a testing cadence agreed around your releases.

Typical duration
Continuous
Scope this test Test plan

What we test

  • Continuous Reconnaissance
  • On-Demand Testing
  • Vulnerability Validation
  • DevSecOps Integration

Who it is for

  • Teams shipping weekly who outgrow a once-a-year test
  • Products with a steady stream of new features and endpoints
  • Security teams that want validation folded into DevSecOps

What you receive

  • Ongoing validated findings as they are confirmed
  • On-demand testing of new releases
  • Fix verification within the subscription

In every engagement

The parts that never change.

  1. 01

    Scoping with an engineer

    Targets, rules of engagement and timeline agreed with the person who will test.

  2. 02

    Evidence for every finding

    Requests, responses, and proof-of-concept steps your team can replay.

  3. 03

    Remediation guidance

    Specific, code-level direction instead of generic advice.

  4. 04

    Retest and updated report

    We verify fixes and record the result for auditors.

How we test What a report looks likeBook a scoping call

How quotes work

Priced from scope, not from a menu.

After a scoping call, you receive a written quote defining the scope, deliverables, timeline and fee. We agree these before testing begins. Booking the consultation does not purchase an assessment.

  • Number of targets

    Applications, APIs, mobile builds, hosts, cloud accounts or devices in scope.

  • Roles and tenants

    Each user role and tenant boundary multiplies the authorization paths to test.

  • Environments

    Production, staging, cloud accounts and on-premises networks each add setup and coverage.

  • Depth and constraints

    Testing windows, source-code access and safety limits shape the effort.

Questions buyers ask

  • A target inventory, user roles, business-critical workflows, your deadline and any testing restrictions. Do not submit credentials or sensitive customer data through the booking form.

Start an engagement

Tell us what you're shipping.
We'll tell you what it's exposing.

Book a 30-minute scoping call with a senior engineer. You'll leave with a clear recommendation on scope, approach, and timeline.

Book a consultation contact@proteqon.com