SecaPenetration testing services
Manual testing across four surfaces — web apps, APIs, networks and AI. Each engagement is fixed scope and fixed price, delivered by senior testers: the people you talk to are the people who test.
Web Application Penetration Testing
We test your application as an attacker with a browser and a proxy. Not a crawler.
What we test
- Authentication and session management
- Authorization, IDOR and privilege escalation
- Injection: SQL, command, template, SSRF
- Business logic and workflow abuse
- Client-side: XSS, CSP bypasses, prototype pollution
- Cryptography and token handling
How we work
- Map roles, endpoints and trust boundaries.
- Test each role against every privileged action.
- Chain low-severity issues into real impact.
- Validate manually before reporting.
API Penetration Testing
APIs fail differently than UIs. We test the contract, not the screens built on top of it.
What we test
- Object-level and function-level authorization
- Token lifecycle, JWT weaknesses, session flaws
- Mass assignment and request-body tampering
- Injection and deserialization paths
- Rate limiting and abuse scenarios
- Verbose errors and leaked secrets
How we work
- Enumerate every endpoint, including undocumented ones.
- Replay each call across role and tenant boundaries.
- Probe business rules: pricing, limits, workflows.
- Confirm impact before it reaches the report.
Network Penetration Testing
External: what the internet can reach. Internal: what one compromised laptop can reach. We test both as separate scopes or one program.
What we test
- Perimeter: firewalls, VPNs, exposed services, cloud front doors
- Internal: segmentation, lateral movement, credential paths
- Privilege escalation and domain takeover routes
- Weak protocols and configurations: SMB, RDP, SSH, DNS
- Reach to sensitive data and critical applications
How we work
- Discover and map reachable assets and services.
- Manually verify settings and exposed functions.
- Build practical attack chains, not CVE lists.
- Simulate the attacker position after first entry.
AI & LLM Penetration Testing
Your AI product has an attack surface: prompts, tools, retrieval stores, memory. Most security teams have never tested any of it.
What we test
- Prompt injection and hidden directives
- Jailbreaks and guardrail bypass
- RAG poisoning and retrieval abuse
- Tool and function-call abuse, escalated authority
- Data leakage: secrets, PII, system prompts
- Model and vendor configuration weaknesses
How we work
- Gather architecture and usage context.
- Map trust edges and abuse routes.
- Run adversary-style checks against live flows.
- Validate impact, spread and escalation.
Compliance and due diligence
Reports built to satisfy auditors and customer security reviews, not just to fill a folder.
- SOC 2 — evidence of an annual, independent penetration test.
- ISO 27001 — findings mapped to control requirements.
- PCI DSS — scope-aligned testing for card-data environments.
- Customer questionnaires — a report your prospects' security teams accept without a call.
Penetration testing FAQ
Straight answers to the questions we get before every scoping call.
How much does a penetration test cost?
How long does a penetration test take?
Do you test in staging or production?
Which standards do you test against?
Not sure which scope you need?
Thirty minutes on a call settles it. No sales script, no obligation.