A customer sent you a security questionnaire
Enterprise buyers ask for a recent pentest report before they sign. You get the report and a signed attestation letter you can forward to them.
Web app and API pentests
A pentest you can hand to your customer or auditor.
We test every user role on every endpoint of your app and API, prove each finding by hand, and show you exactly what we checked. Fixed price, retest included.
Get a fixed quoteWhat the report contains
- 1 day
- to your fixed quote
- 5-15
- working days to the report
- 90 days
- to retest your fixes, included
When teams call us
Your auditor asks for a pentest
SOC 2, ISO 27001, PCI DSS, NIS2. The report states scope, dates, method, tester and retest result: the points auditors check.
How the report maps to your auditYou are launching an AI feature
We test prompt injection, data leaking through the model and misuse of the tools it can call, against the OWASP Top 10 for LLM applications.
You are bidding for a big contract or tender
Government and enterprise buyers want a recent independent test. You get one in one to three weeks, at a price you know before you start.
What you get
A report people can read
A plain-language summary for management. Per finding: the proof (request, response, screenshot), the impact, the fix and a risk rating.
A coverage matrix
Every endpoint and role against every OWASP ASVS requirement at your tier's level, marked passed, failed, not applicable or not tested, with the reason. A clean report says what was tested, not just that nothing was found.
A signed attestation letter
One page for customers and auditors: scope, dates, method, tester, results by severity. We update it after the retest.
A call the same day for critical findings
If we find something critical, you hear about it the same day, not in the final report.
| Endpoint | Visitor | User | Admin |
|---|---|---|---|
GET /api/invoices/{id} | Passed | Failed | Passed |
POST /api/invoices | Passed | Passed | Passed |
DELETE /api/users/{id} | Passed | Failed | Passed |
POST /api/assistant/chat | Not applicable | Passed | Not tested, with reason |
Three levels of depth, a fixed price for each
Basis
The baseline every app should meet.
- Scope
- 1 web app or API, up to 25 endpoints, 2 user roles
- Depth
- OWASP ASVS level 1, every role
- Report ready
- 5 working days
Recommended
Standaard
For apps that hold personal or business data.
- Scope
- 1 web app and its API, up to 75 endpoints, 3 user roles
- Depth
- OWASP ASVS level 2; every role on every endpoint; your AI features
- Report ready
- 10 working days
Diepgaand
For apps where a lot is at stake.
- Scope
- Up to 2 apps, 150 endpoints, 5 user roles
- Depth
- OWASP ASVS level 3 where it applies; source code read alongside the live test; a threat-model session first
- Report ready
- 15 working days
How it works
Scope call
Twenty minutes. We agree what is in scope and send you a fixed price.
Order and permission
You sign the order and a written authorisation from the system owner. We agree the test window and request rate.
Test
Five, ten or fifteen working days, depending on the tier. Critical findings are reported the same day.
Report and retest
You get the report and attestation letter. We retest your fixes within 90 days and update the letter.
You talk to the person who tests
No account manager in between. The tester who scopes your app is the one who tests it, writes the report and walks your developers through it.
Questions buyers ask
Why not an automated scan or an AI pentest tool?
A scan reports what might be wrong. We prove what is wrong, for every role, and show what we checked. Auditors and enterprise buyers ask for that proof.
Why not a big firm?
The same public standard (OWASP ASVS), a fixed price, results in one to three weeks, and you talk to the person who tests.
Are you certified?
No certificate is required by law to test your app, in the Netherlands or for SOC 2. Judge us by the method, the sample report with its coverage matrix, and our references.
Is it legal?
Only with written permission from the owner of every system in scope. That permission is part of the order, and we don't start without it.
Do you use AI?
Yes, as tools under our direction. Every finding is reproduced and proven by a person. The model providers are listed in the processing agreement, and you can opt out at no extra cost.
Can you test production?
Staging is preferred. If we test production, we agree a window and a request rate, run no destructive actions and stop at once if you ask.
Do you work outside the Netherlands?
Yes. We test remotely and write reports in English or Dutch. We quote and invoice in EUR or USD.
Need a pentest by a date?
Tell us what to test and when you need the report. You get a fixed price within one working day.