Application Security Review
Weaknesses identified in authentication, authorisation, sessions, APIs and sensitive data handling.
- Best for
- Product and engineering teams reviewing important application controls, requirements and implementation evidence.
- Typical timing
- 7-15 business days
- Primary output
- Application Security Review
Questions this engagement answers
- Are identity, access and session controls designed correctly?
- Where do implementation choices fall short of agreed requirements?
- Which fixes reduce the most material risk first?
What you receive
Deliverables are tailored to complexity and scope. The exact scope is confirmed in writing before work begins.
- Authentication, authorisation and session review
- Findings mapped to OWASP ASVS requirements
- Remediation backlog with engineering guidance
What we need from you
Having these ready shortens the engagement and keeps the fee predictable. If something is missing, say so and we will work around it.
- Written authorisation from the system owner
- Architecture notes and the technology stack
- A test environment and non-production account
How the engagement starts
Review the decision
We read your request and identify the decision that needs to be made.
Confirm the scope
You receive timing, deliverables, boundaries and a firm fee in writing.
Agree secure access
Work begins after the scope and information-sharing method are agreed.