Our $495 external test sees what an anonymous visitor sees. An authenticated test logs in with test accounts you provide for each role and tenant, then checks what each user can reach that they should not: other customers' data, admin functions, broken flows. Most of that needs a person with two logged-in sessions, so this is a quoted, time-boxed engagement, not an off-the-shelf scan.
In NIST SP 800-115 terms this is gray-box testing. Test IDs follow the OWASP Web Security Testing Guide v4.2, the OWASP API Security Top 10 (2023) and ASVS 5.0. It is non-destructive and runs only against the assets, roles and accounts named in the statement of work.
What it covers
- Your listed web app hosts and API endpoints, after login, for every agreed role
- Access control: can one user reach another user's data (horizontal) or an admin's functions (vertical)?
- Login, password reset, MFA, session handling and logout flows
- Input handling, error handling and business-logic flaws reachable only when logged in
- Cross-tenant isolation (two tenants, two roles each) when that module is included
- REST or GraphQL APIs from your spec, against the OWASP API Security Top 10, when that module is included
- One retest of reported findings within 60 days, with an updated report
What it does not cover
- A guarantee of no vulnerabilities, a pre-written “0 findings” report, or a compliance certification
- Third-party platforms you build on: Amazon, Shopify, Salesforce or your identity provider (Okta, Auth0, Entra)
- Denial-of-service, load testing, brute force or credential stuffing against real users
- Social engineering, phishing or physical access
- Using a flaw beyond proving it exists: no pivoting, no data changes, no secret dumping
- Source code review, mobile app binaries, internal networks or hosts behind a VPN (separate engagements)
An authenticated scan (a scanner logged in as one user) is not an authenticated test. It finds known CVEs and misconfigurations behind the login but misses access-control and tenant-isolation flaws, because those depend on what each user should be allowed to see.
Modules
Module A is the base. B, C and D are add-ons. Mobile app testing is not offered yet.
| Module | You provide | We test |
|---|---|---|
| A. Authenticated web app (base) | Two or more roles, two users per role, a URL list, staging preferred, an MFA workaround | Identity, authentication, authorization, sessions, input and error handling, business logic, browser-side issues (OWASP WSTG) |
| B. API (REST or GraphQL) | OpenAPI or Postman collection, a token per role, rate-limit guidance | Object- and function-level authorization, property-level access, business flows, misconfiguration, inventory (OWASP API Top 10 2023) |
| C. Multi-tenant isolation | Two tenants with two roles each and seeded data in both | Cross-tenant data access, tenant IDs used as selectors, caches, signed URLs, exports and async jobs |
| D. Cloud configuration review (read-only) | A read-only audit role in AWS, Azure or Google Cloud | Public exposure, IAM hygiene and CIS-style configuration checks, ranked by real exposure |
How an engagement runs
- A 20-minute scoping call: app URLs, roles, tenants, API spec, hosting, staging or production, your deadline and the reason for the test.
- A fixed quote and statement of work: modules, targets, roles, testing window, report date and retest window.
- A signed authorization letter from the asset owner naming every domain and the hosting provider.
- Your setup: test accounts for each role and tenant, an MFA workaround, our testing IP allowlisted. We log in with every account before day one.
- Testing window. Critical findings go to your named contact the same day.
- Report with evidence and fixes, plus an attestation letter covering the tested scope and dates.
- One retest within 60 days and an updated report showing what was fixed.
Nothing starts until the signed authorization and working test accounts are in hand. Pricing is per engagement and depends on modules, roles and endpoint count; you get a fixed quote after the scoping call. Need the outside view every week instead? See Continuous External Monitoring.
Get a quote
Tell us what you need tested. We reply within one business day with next steps or a quote.