You have built a web application. It works, people want it, and now a customer has come back with a security questionnaire asking for a penetration test before they will go ahead. You are not trying to build a security program this quarter. You need a credible answer to one question, from someone whose name holds up when their security team reads it, and you usually found out you needed it last week.
This assessment is built for exactly that situation. It is a genuine web application penetration test, carried out by a certified penetration tester at a CREST accredited Australian company, with the scope fixed to the OWASP Top 10 so the price and the timeframe stay where you need them.
You built it quickly
You or a small team shipped a working application, possibly without a dedicated security person anywhere near it. That is normal now, and it is not a criticism.
Someone else set the requirement
A customer, a procurement team or a questionnaire asked for a penetration test. They may well have named the OWASP Top 10 specifically.
You need it resolved, not expanded
A full testing program is the right answer eventually. Today you need a report you can send, quickly, at a price that matches the stage you are at.
Fixed scope means you know what you are buying before you pay, and we know when the work is finished. Both halves of that matter.
| Included | Detail |
|---|---|
| Application | One web application, one environment, production or staging |
| User roles | Up to three authenticated roles, for example admin, standard user and customer |
| Coverage | The full OWASP Top 10:2025, tested against your application |
| Limited API testing | The APIs your web application itself calls, tested as they interact with the application |
| Access control | Checks for access between the accounts you supply, including data belonging to one account being reachable from another |
| Who does it | A certified penetration tester based in Australia, at a CREST accredited company. Not a scan with a logo on it. |
| Verification | Every finding reproduced and confirmed by hand before it reaches the report |
| Report | Executive summary, findings ranked by business impact, evidence, and specific remediation advice |
| Attestation letter | A one page letter stating scope, methodology, dates and accreditation, written to be forwarded to your customer |
| Questions | Your tester answers written questions on the report by email |
This is the part that keeps the price where it is. None of it is hidden, and if you need any of it, say so and we will quote the full test instead.
| Not included | Why, and what to do about it |
|---|---|
| Debrief meeting | No walkthrough call. Written questions by email are included instead. |
| Retesting | Optional extra at $975 excluding GST. Worth adding if your deadline is an audit rather than a customer. |
| Standalone API testing | Documented or public API endpoints that sit outside the web application, or an API your customer has named separately, need the full test. |
| Infrastructure | No network, server or cloud configuration testing. |
| Source code | No code review. This is testing from the outside, as an attacker would. |
| Mobile apps | Web application only. |
| Social engineering | No phishing or staff targeted testing. |
| Anything outside OWASP | Testing follows the OWASP Top 10 categories. Risks outside them are out of scope for this assessment. |
This is the list your customer’s security team is most likely referring to. We test your application against all ten.
A01Broken Access Control
A02Security Misconfiguration
A03Software Supply Chain Failures
A04Cryptographic Failures
A05Injection
A06Insecure Design
A07Authentication Failures
A08Software or Data Integrity Failures
A09Security Logging and Alerting Failures
A10Mishandling of Exceptional Conditions
The two highlighted categories are the ones we find most often in applications that were built fast.
A03 Software Supply Chain Failures is new at number three. An application assembled at speed pulls in a lot of dependencies nobody chose deliberately, and some of them are already known to be vulnerable.
A06 Insecure Design covers the problems that come from how something was built rather than from a single mistake in the code. It is the category a scanner is least able to see.
The report
An executive summary your customer’s manager can read, and a technical section your developer can act on. Findings are ranked by what they would mean for your business, not by a raw tool score. Every one includes the evidence and what to change.
The attestation letter
One page, signed, stating what was tested, when, by whom, under what methodology, and that the testing was performed manually by a certified tester at a CREST accredited company. This is the document you forward.
1. Complete the scoping form
About five minutes, and it commits you to nothing. It tells us what the application is, how many roles it has and where it is hosted, so the scope and the timeframe are accurate rather than a guess. Start the scoping form.
2. We call you
A short call to confirm the scope is right, answer your questions, tell you plainly if the full test would serve you better, and agree a delivery date against your deadline.
3. You provide access
A URL and one working login for each role you want covered, up to three. No agents, no installation, nothing to deploy.
4. We test
Hands on keyboard against the OWASP Top 10, with every finding reproduced by hand before it is written up.
5. Report and letter
Fast turnaround once testing finishes, with the date agreed up front. Send the letter to your customer the same day it arrives.
Worth having to hand before you start. The application name and address, roughly how many dynamic pages it has, how many user roles you want covered, whether it is multi-tenant, where it is hosted, whether we would be testing staging or production, and how users log in.
We would rather tell you now than have you send your customer a report that does not cover what they asked for. Any of these and this is the wrong product.
| If this is true | Why |
|---|---|
| Your customer named a standalone API | APIs inside the application are covered. A documented API your customer has named separately is scoped and charged on its own. |
| You run a multi-tenant platform | Where one customer’s data sitting behind another customer’s login is the real risk, tenant isolation deserves proper time. |
| Your deadline is a SOC 2 or ISO 27001 audit | Assessors generally expect retest evidence for critical and high findings. Add the retest, or take the full test. |
| You have complex permissions | More than three roles, or authorisation rules that differ per customer, will not be covered properly in a fixed scope. |
| Infrastructure is in scope | Servers, cloud configuration and internal networks are a different engagement. |
If one of these applies we will quote the full web application penetration test instead. Our published prices are on the penetration testing pricing page, and the full service is described on our web application penetration testing page.
Yes. A certified penetration tester tests your application by hand against the OWASP Top 10, and verifies every finding before it goes in the report. What makes it cheaper is the scope, not the method. An automated scan with a report template around it is a different thing, and some security teams and auditors will recognise it as such and reject it.
In most cases, yes. Where a customer has asked for a penetration test covering the OWASP Top 10, this answers it directly, and the attestation letter states the scope and the accreditation plainly. Send us the questionnaire before you order and we will tell you honestly whether this covers it or whether you need the full test.
Quickly. Testing itself is short because the scope is fixed, and the report and attestation letter follow fast. Scheduling is usually the longest part, so tell us your deadline at the scoping call and we will confirm a delivery date before you commit.
Retesting is an optional extra at $975 excluding GST rather than included, which is part of how the price stays where it is. If your deadline is a SOC 2 or ISO 27001 audit rather than a customer, we recommend adding it, because assessors generally expect to see retest evidence for critical and high findings.
No. We use our own tooling, hosted in our own environment. Your application and your data are not sent to any third party service, and every finding is confirmed by a human tester before it reaches you.
We will say so at the scoping call and quote the full web application penetration test instead. We would rather lose the smaller sale than give you a report that does not hold up when your customer reads it.