Penetration testing for web applications and APIs. Deterministic reconnaissance gathers the evidence, AI-assisted analysis draws the inferences, and automated or human verification proves them before anything reaches your report.
Automation, models and people each do the part they are best at. Observation and inference repeat until nothing new turns up; only then does anything go to proof.
Deterministic reconnaissance
Hosts, routes, parameters, technologies and authentication flows are enumerated by a fixed, versioned procedure. The same scope produces the same record, every request is logged, and any run can be replayed and compared with the last.
AI-assisted analysis
Models read the record the way an experienced tester would: correlating weak signals, proposing attack paths and chaining minor issues into material ones. Each hypothesis cites the observations it rests on and states its confidence.
Verification, automated or human
A hypothesis becomes a finding only once it has been demonstrated. Safe checks are verified automatically; anything consequential is verified by a tester. Rejected hypotheses are logged, never reported.
Each round of reconnaissance gives the models more to reason about, and each inference sends reconnaissance somewhere new: an undocumented route, a parameter worth testing, two weaknesses that only matter together. The loop runs until nothing new turns up. Then the strongest hypotheses go to proof.
Nothing is reported that cannot be reproduced.
Automated scanners list what might be wrong. We report only what has been demonstrated, and include the requests that demonstrate it, so your engineers can confirm each finding themselves and check the fix the same way.
How many sites are in scope, how deep testing goes, and how much of the work is done by a person. The three packages are common combinations; any other can be scoped.
The web applications, APIs and domains in scope. Each is enumerated and recorded on its own.
Choose when a tester returns: monthly, quarterly, before each release, or only inside agreed windows. Because reconnaissance is deterministic, each pass is compared with the last. You see what changed, not the same list again.
A tester reviews the month’s changes to your record and proves anything new.
12 passes a yearA deeper pass each quarter, timed to your reporting or audit cycle.
4 passes a yearPlanned from your deployment calendar, ahead of changes reaching production.
On your release datesTesting only inside agreed hours, such as nights, weekends or maintenance windows, and never during a freeze.
Your hours, your time zoneWhat was observed, what was inferred from it, and how it was demonstrated, in that order, with the raw requests attached.
Every engagement is authorized in writing and runs inside limits you set.
A short call to set sites, depth and human involvement, followed by a written proposal.
Signed authorization and rules of engagement: testing windows, rate limits, exclusions and contacts.
Reconnaissance, inference and verification run inside the agreed window. Critical findings are escalated as soon as they are proven.
The report is walked through with your team. Fixes are retested against the same record.
One short call is enough to set sites, depth and how much of the work you want done by a person. You leave it with a written proposal.