Product Security Assessment

Overview

We assess the security of applications, APIs, platforms and cloud-hosted services, whether you build them or are about to adopt them. The assessment covers architecture and configuration as well as hands-on testing for common and business-logic weaknesses.

Business objectives

• Identify exploitable weaknesses before release or adoption
• Verify authentication, authorization and data protection
• Give developers clear, prioritized fixes
• Support customer, partner or regulatory security requirements

Why it matters

Applications and APIs are a frequent route to sensitive data. Issues found before release are far cheaper to fix than those discovered in production or by an attacker.

Common challenges we address

• A new product or major release approaching
• Customers asking for evidence of security testing
• Third-party platforms being adopted without security review
• APIs exposing more data than intended

Deliverables and outcomes

• Executive summary
• Technical findings with risk ratings and evidence
• Remediation guidance for developers
• Retest report

Typical use cases

• Pre-release testing of a web or mobile application
• API security testing
• Vendor or SaaS security review before purchase
• Periodic testing of customer-facing systems

Who it is for

• Product and engineering leaders
• Application security teams
• CISO
• Procurement and vendor risk teams

Engagement options

• Web application assessment
• API assessment
• Mobile application assessment
• Cloud service / SaaS configuration review

Prerequisites

• A stable test or staging environment
• Test accounts for each user role
• API documentation or collections
• Written authorization from the system owner (and hosting provider where required)