Application & Mobile Security Review
An application can pass a network test and still hand over every customer record, because the flaw is not in the infrastructure. It is in the logic.
Changing one identifier in a URL and seeing somebody else’s invoice is not a misconfiguration a scanner reports. It is a design decision nobody questioned. We test what your application lets people do that it should not, across web, mobile and the code behind them.
Four situations that bring teams to us
You are shipping something new
Or you have shipped a great deal very quickly, and nobody outside the team has reviewed it.
A customer sent a security questionnaire
They want evidence of independent application testing, and a deal is waiting on your answer.
Your application handles money, health or personal data
The consequences of a logic flaw are not theoretical, and neither is your regulator.
Strong developers, no application security specialist
Good engineers miss authorisation flaws in their own code for the same reason writers miss their own typos.
Coverage across the application stack
Web applications
Authentication and session handling, access control both horizontal and vertical, injection, file handling, and business-logic abuse, where a workflow can be completed in an order nobody designed for.
Mobile, Android and iOS
Local data storage, transport security and certificate handling, communication between components, resistance to reverse engineering, and the backend the app talks to, which is usually where the significant findings are.
Databases at application level
Database testing through the application layer: what the application will return, to whom, and under what conditions.
Secure development and code review
Reviewing the code behind the behaviour we observe, which finds classes of defect that black-box testing cannot reach in a sensible timeframe.
Interfaces and APIs
The endpoints behind your web and mobile clients: authorisation checked per object and per action, rate limiting, and the excess data an endpoint returns that the interface simply never displays.
Grey-box by default
You give us accounts at each privilege level, and we test what each one can reach. It mirrors the realistic threat, which is a legitimate user, a leaked credential or a malicious customer, and it spends your budget on depth rather than on us guessing your URL structure.
Testing follows established international application security methodologies, chosen for the application in front of us rather than applied uniformly. We confirm the approach with you during scoping.
What we ask you for
One account per role, a stable environment, and someone on your side who can answer a question about intended behaviour. That is usually the whole list.
What your developers actually get
- Findings in a form your team can work from directly: title, severity, affected endpoint, reproduction steps and evidence.
- Severity that accounts for context. What the flaw exposes, for which users, and what an attacker needs in order to exploit it.
- Guidance on the fix, and on the pattern that stops the same class of defect returning next sprint.
- A debrief with the people who will do the fixing, not only with whoever commissioned the test.
- Retesting after remediation, on terms agreed for the engagement.
How we scope an application test
Application engagements vary more than infrastructure ones. The number of user roles, the number of workflows, whether an API and a mobile client are included, and whether we have source access all change the work substantially. We scope on a call and quote a fixed price for that scope.
We will also tell you when not to test
Testing a build that is about to be replaced is an expensive way to generate a document. If your application is not ready, we would rather say so before you commit than bill you for finding out.
Common questions
Do you need our source code?
Should we give you staging or production?
What happens to our data?
Can you test on every release?
We rely on third-party components. Are those covered?
Is this the same as a penetration test?
Certifications held across our team
Describe the application
Tell us what it does and who uses it, and we will tell you what it needs tested and how we would scope it.
Contact Cyberange