Services
Penetration testing and reporting
A penetration test shows how a real attacker could move through your application. We test only what you own and have authorised in writing, then give you findings you can reproduce, rank and fix.
Scoped and quoted for each engagement. No standard price list.
Who it is for
Built for teams like yours.
- Software teams shipping web applications or APIs
- Companies asked for a test by customers, partners or insurers
- Teams that want findings tracked to closure, not left in a PDF
Web applications and APIs
Authentication, session handling, access control, input handling, business logic and multi-tenant isolation, guided by OWASP WSTG and ASVS.
External attack surface
Internet-facing hosts and services you own, including exposed management interfaces and misconfiguration.
Methodology
Structured around PTES and OWASP guidance, with manual testing alongside tooling.
Retest
Fixed findings are retested, within a window set in the statement of work.
What you receive
Deliverables you can use.
- 1Executive summary in plain language
- 2Technical findings with evidence and reproduction steps
- 3CVSS-rated risk for each finding
- 4Remediation guidance for developers
- 5Retest confirmation for fixed findings
Connected to the platform
Findings do not end up in a PDF drawer.
SecureDev
Findings can be imported into your application inventory and assigned to developers.
RiskGuard
Accepted risks are recorded with owner, rationale and review date.
AuditPilot
The report can be attached as evidence for assessments that ask for testing.
How it works
A clear process, agreed in writing.
01
Authorise
Written authorisation and rules of engagement, covering targets, windows and contacts, before any testing starts.
02
Test
Manual and tool-assisted testing within the agreed scope and time.
03
Report
A report with evidence, risk ratings and fixes, walked through with your team.
04
Retest
We confirm fixes for the findings you remediate.
Not included
- Denial-of-service or load testing
- Social engineering or physical testing, unless agreed in writing
- Third-party platforms or hosts outside your authority
- Any statement that an application is free of vulnerabilities
Guidance, not a guarantee
StrikeWard provides security guidance, tooling and advice. No service, report or software can prevent every breach, and we do not guarantee any security, compliance or audit outcome. You decide what to implement and remain responsible for your systems. Services are delivered under a signed statement of work and our professional services terms and terms of service. Nothing here limits rights you have under the Australian Consumer Law.