Alcyon
Information Security
Home/Services/Penetration testing
Web applications, APIs, mobile apps and internal networks, tested by hand inside an agreed window. Every finding arrives with the steps to reproduce it, ranked in the order I would fix them.
Authentication and session handling, access control between accounts and between roles, injection into whatever the application talks to, and the business logic that only makes sense once you understand what the application is for. The last category is the one scanners never find.
REST and GraphQL, including the endpoints that are not in the documentation. Object-level authorisation, mass assignment, missing rate limits, and what happens when a client sends a field it should not know about.
Android and iOS. What the binary gives away, what the app stores on the device, what it accepts from other apps on the same phone, and whether the backend trusts the client more than it should.
What one foothold turns into. Credential reuse, service misconfiguration, and the path from an ordinary workstation to something that actually matters.
A call, then a short written document: which systems, which accounts, which windows, and what is explicitly out of bounds. You get a fixed price before anything starts.
Hands on keyboard inside the agreed window. Anything critical reaches you the same day it is found, with enough detail to start acting on before the report exists.
Findings ranked by what I would fix first. Each one carries reproduction steps, the impact stated in terms of your systems rather than a generic severity label, and a concrete remedy.
Once the fixes land, I verify them and reissue the report. Included in the original price.
A contact who can answer questions during the test, credentials for each role you want covered, and a written go-ahead from someone entitled to give it.
For anything hosted by a third party, check your contract first. Some providers require notice before testing.
Usually both. Testing without credentials shows what a stranger reaches. Testing with them shows what one compromised account turns into, which is almost always the larger number.
Unauthenticated-only testing is possible if that is genuinely your threat model, but it tends to buy less than it costs.
It can, which is why scope says which systems and which windows. Destructive checks are agreed in advance or not run at all.
If you have a staging environment that genuinely matches production, that is usually the better target. Where it does not match, testing it mostly proves things about staging.
Both come out of scoping, and both are fixed in writing before the work starts. Scope drives duration; duration drives price.
Yes.
You get the report anyway, including what was tested and found sound. That is the part that makes the result mean something — a report with no findings and no method behind it says nothing at all.
Start a conversation
Replies within one working day. Dutch or English.