ZW-Labs · Penetration testing

Every way in.
We try it first.

Hands-on testing of the systems your business runs on. Every finding comes with evidence and a specific fix, and we retest once you've fixed it.

We test the app your customers log in to, across every role, the way someone who wants their data would.

What we look at

Authorisation between roles and between tenants
Login, session and password-reset flows
Injection of every kind: SQL, template, command, header
Business logic specific to how your product works
File upload, SSRF and deserialisation

Example findingcritical

Any signed-in customer can read any other customer's invoices

Mapped to

OWASP ASVS
OWASP Top 10
SOC 2
ISO 27001
PCI DSS

Quote for web applications →

APIs expose your data model directly. We test every endpoint — documented or not — for what it gives away.

What we look at

Object- and function-level authorisation
Mass assignment and over-exposed fields
Tokens, API keys and OAuth flows
Rate limits and abuse of business flows
GraphQL introspection and batching

Example findinghigh

Setting "role": "admin" on a profile update is accepted

Mapped to

OWASP API Top 10
SOC 2
ISO 27001
PCI DSS

Quote for apis →

An LLM feature is a new way into your systems. We test what it can be made to say, reveal and do.

What we look at

Direct and indirect prompt injection
System-prompt and data disclosure
Other users' data leaking through retrieval
Tools and actions the model can be tricked into
Unsafe rendering of model output

Example findinghigh

A shared document makes the assistant email its contents to an outsider

Mapped to

OWASP LLM Top 10
NIST AI RMF
ISO 42001

Quote for ai & llm features →

Most cloud breaches start with a setting, not an exploit. We find the ones that actually lead somewhere.

What we look at

Over-privileged roles and trust policies
Public storage, snapshots and shared links
Exposed services and network paths
Kubernetes and container configuration
Secrets in pipelines and instance metadata

Example findingcritical

A CI role can assume the production admin role

Mapped to

CIS Benchmarks
SOC 2
ISO 27001
HIPAA

Quote for cloud →

A mobile app ships your client code to every attacker who downloads it. We test the app and what it talks to.

What we look at

Data stored on the device
Transport security and certificate pinning
Hard-coded secrets and reverse engineering
Deep links and inter-app communication
The backend API, from the app's side

Example findingmedium

Session token written to the device log in plain text

Mapped to

OWASP MASVS
OWASP Mobile Top 10
PCI DSS

Quote for mobile →

From the internet we find what's exposed. From inside we show how far one compromised laptop gets.

What we look at

Exposed services and remote-access gateways
Segmentation between networks
Active Directory attack paths
Credential exposure and lateral movement
Wireless, on request

Example findinghigh

A backup service account's password is crackable offline

Mapped to

PTES
NIST SP 800-115
SOC 2
PCI DSS

Quote for networks →

We test the app your customers log in to, across every role, the way someone who wants their data would.

What we look at

Authorisation between roles and between tenants
Login, session and password-reset flows
Injection of every kind: SQL, template, command, header
Business logic specific to how your product works
File upload, SSRF and deserialisation

Example findingcritical

Any signed-in customer can read any other customer's invoices

Mapped to

OWASP ASVS
OWASP Top 10
SOC 2
ISO 27001
PCI DSS

Quote for web applications →

How it runs

Scope, test, report, retest.

Nothing is touched until scope and written authorisation are agreed.

Before we start
Scope
We agree targets, test accounts, timing and rules of engagement. You sign a written authorisation.
During the test
Test
Hands-on testing. Anything critical comes to you the day we find it, not in the final report.
When testing ends
Report
An executive summary for leadership, and every finding with evidence, severity and a specific fix.
When you're ready
Retest
We verify each fix and reissue the report showing what's closed — ready for auditors and customers.

Questions

Before you book.

How long does a test take?Open +

It depends on scope. A focused web or API test is usually one to two weeks of testing. You get a timeline with the proposal, before anything is agreed.

What do you need from us?Open +

What's in scope, test accounts where relevant, a testing window, and a signed authorisation. We send a short scoping questionnaire to make it quick.

Will it affect production?Open +

We agree the environment and any excluded actions first. A staging copy of production is preferred; where we must test production, destructive checks are excluded or scheduled with you.

Can the report support SOC 2, ISO 27001, PCI DSS or HIPAA?Open +

Yes — it's structured to serve as independent testing evidence. Certifying compliance is your auditor's job; we give them what they need from a test.

Tell us what needs testing — or watching.

Get a quote →

Every way in.We try it first.

We test the app your customers log in to, across every role, the way someone who wants their data would.

We test the app your customers log in to, across every role, the way someone who wants their data would.

Scope, test, report, retest.

Before you book.

Every way in.
We try it first.