Vulnerability Assessment and Penetration Testing
Quoted on scope, fixed price. Includes the Vexil platform and a hand-verified retest.
Teams who have had us test their systems
- Selip & Stylianou, LLP
What this covers
Your startup moves fast. Your security testing shouldn't slow you down - but skipping it can kill a deal, a fundraise, or your reputation. Our VAPT engagements cover six attack surfaces: web applications, APIs, network infrastructure, mobile apps, Active Directory, and thick client applications. We combine automated scanning with hands-on exploitation by certified penetration testers - people who think like attackers and write like engineers. Every finding in your report is manually validated and includes clear reproduction steps your dev team can act on. You get an executive summary for your board and a technical report for your engineers, generated from the same engagement so the two cannot disagree, in Word, PDF or Excel. Where a customer or auditor needs it mapped to PCI DSS, SOC 2, ISO 27001 or the HIPAA Security Rule, that is another export of the same work rather than another engagement. A penetration test is evidence that may support an assessment; it is not a certification or an attestation, and we do not issue one.
- Pass any customer security questionnaire in hours, not weeks
- Close enterprise deals with an audit-ready security report
- Sail through investor due diligence without scrambling
- Launch on time - not delayed by last-minute security surprises
Scope
What gets tested
Ten areas, agreed on the scoping call and written into the rules of engagement before anything starts.
Web Applications
OWASP Top 10, authentication, session, injection, XSS, CSRF, business logic testing.
APIs & Microservices
REST, GraphQL, gRPC - BOLA, rate limits, token handling, mass assignment.
Network Infrastructure
External & internal pentest, segmentation, firewall rules, exposed services.
Mobile Applications
iOS & Android static/dynamic analysis, data storage, API backend.
Active Directory
Kerberos, LDAP, privilege escalation, GPO misconfigurations, lateral movement.
Thick Client Apps
Binary analysis, local credential storage, IPC, update mechanisms.
Business Logic Flaws
Price manipulation, coupon abuse, workflow bypass, race conditions.
Multi-Step Attack Chains
Chaining low-severity findings into full compromise paths.
OWASP Top 10 & ASVS
Full coverage aligned to OWASP testing standards.
SANS Top 25
Most dangerous software errors actively exploited in the wild.
Why a scan is not a test
What a scanner misses here
For part of it. But the problems that cost you money sit behind a login, and a scanner cannot log in as two people and compare what they see. A person can.
Scanner
Finds what is there
- Open ports and services
- Publicly known vulnerabilities (CVEs)
- Default passwords
- Weak TLS, missing headers
- Outdated software
Fast, and worth running.
Tester
Finds what is broken
- One customer reading another’s data
- A regular user granting themselves admin
- A password reset that takes over an account
- A price changed in the browser and trusted
- Two safe steps chained into an attack
This is where the real risk is.
We run both, in that order. Tool output is kept separate from what a tester wrote, so you always know which is which.
Book a Free ConsultationApproach
How much we are told beforehand
Each approach answers a different question. We will recommend one on the scoping call and explain why.
Black Box
Zero prior knowledge
We test like an external attacker-no source code or internal docs. Ideal for realistic breach simulation.
Grey Box
RecommendedLimited knowledge - most popular
You share architecture overview and test accounts. Balances real-world attack paths with efficient coverage.
White Box
Full transparency
Source code, configs, and documentation in scope. Maximum depth for critical apps before launch or audit.
Methodology
How the work is done
Repeatable, documented, and tracked as coverage inside the platform so you can see what has been looked at.
- 01
Scope & Plan
We map your attack surface, define rules of engagement, and agree on testing windows - typically a 30-minute call.
- 02
Test & Exploit
Deep manual analysis of your attack surface by certified penetration testers. We find what automated tools miss, chain vulnerabilities into real attack paths, and exploit every finding by hand.
- 03
Report & Walkthrough
You get an executive summary, a technical report with proof-of-concept, and a live walkthrough of every critical finding.
- 04
Fix & Re-test
We support your devs during remediation, then re-test to confirm every critical and high finding is truly closed.
Why it matters
What you get out of it
Find Real Vulnerabilities
Manual testing validates findings and uncovers business logic flaws, authentication bypasses, and chained exploits that scanners miss.
Prioritized Remediation
Each finding is rated by severity and exploitability so your team fixes what matters first.
Compliance Ready
Reports aligned with PCI-DSS, ISO 27001, SOC 2, and customer security assessment requirements.
Fixed Pricing & Timeline
Transparent scopes, typically five to ten working days, and no surprise change orders mid-engagement.
Expert Support
Direct access to testers during remediation; we help your developers understand and fix issues.
Re-test Included
Verification testing is included: after you patch, a tester confirms each fix by hand.
What you receive
Delivered in the platform as the work happens, and exportable as a document whenever you need one.
- Executive summary - board-ready, 2-page risk overview with business impact ratings
- Technical findings report - every vulnerability with CVSS score, proof-of-concept, and reproduction steps
- Remediation playbook - prioritized fix list mapped to your sprint cycles
- Video walkthrough - recorded session covering every critical finding
- Re-test validation - confirmation report after fixes are applied
Standards we test against
Coverage is tracked against these inside the platform, so “what did you actually check” has an answer.
- OWASP
- PTES
- OSSTMM
- NIST CSF
- PCI-DSS
- ISO 27001
In their words
What clients said about VAPT
Cybersecly truly IMPRESSED us with their work in VAPT & Review! Their attention to details and deep understanding made the project flow smoothly, and their professionalism exceeded our expectations. Working with such a team who’s quick to respond and consistently goes above and beyond was a genuine pleasure. 👏
CISO, AI company
Named and attributed on request, with the client’s permission. Most testing work is covered by an NDA, so we publish the role and the sector rather than the company.
The anatomy of a finding
This is one finding.
Not a report. One finding, with every field it carries and why each field is there. Yours will look like this.
Vexil · Finding
Published- Titlewhat it is, in your engineers’ words
Two low-risk issues chain into an administrator session.
- Affected assetthe specific endpoint of the application
Neither endpoint is a finding on its own.
- POST /auth/reset
- GET /users/me
- Severitycomputed from the vector, never chosen by hand
- high
- CVSS 3.1 · 9.1
- AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CWE-640
- Evidencethe request, the response and screenshots, attached to the finding
The reset endpoint confirms which addresses exist, and the token it issues does not expire on use.
- POST /auth/reset → 200 "sent"
- POST /auth/reset → 404 "unknown"
- Impactwhat it costs you, not what the CVE says
An address list turns into a working administrator login. Neither half would have been reported by a scanner, and neither is above medium alone.
- Remediationfor your stack, not “apply vendor patches”
Answer identically whether or not the address exists, and expire the token on first use. Fixing either one breaks the chain; fix both.
- Retesta tester’s verdict, not your self-assessment
Retest passed. Verified by hand, recorded with the date and the tester.
This is the format, not a client’s work - it is written against the demonstration environment we run for the purpose, and a real finding also carries screenshots of the issue alongside the request and response. We don’t publish client findings, redacted or otherwise. If you want to see a real one, email us and we’ll send a redacted sample.
Pricing
What changes the price
Every engagement is quoted on scope rather than hours. These are the four things that move it, and they are what we work through on the call.
Applications
How many
Size
Pages and endpoints
User roles
How many to test
APIs, networks
In scope or not
Delivered on the Vexil platform
Findings arrive as they are confirmed rather than in a report weeks later, your engineers get the request that proves each one, and a retest is a click rather than a new purchase order.
See the platformFAQ
Questions about VAPT
What tools do you use, and do you just run automated scans?
We use Burp Suite Pro, Nessus, Metasploit, Nmap, BloodHound, and custom scripts - but the tools are where testing starts, not where it ends. Every finding is manually validated. We exploit confirmed vulnerabilities to demonstrate real business impact, not just flag theoretical risks. Scanners miss business logic flaws, auth bypass chains, and IDORs - our testers find them.
Do you test on production, and will it cause downtime?
Web and API testing runs against staging whenever available. Production tests use rate-limited, non-destructive techniques and are scheduled during agreed maintenance windows. Destructive and denial-of-service techniques are excluded unless you ask for them in writing, the limits are written into the rules of engagement before testing starts, and we brief your on-call team so they know what they are seeing.
How do you handle false positives in reports?
Every finding in your report has been manually verified and exploited where safe to do so. We do not ship scanner output as a report. If you believe a finding is a false positive, we will re-verify it on a call - if we are wrong, we will retract it and explain why the tool flagged it.
What is your re-test policy after we fix issues?
A full re-test of critical and high findings is included once your team has applied fixes. A tester verifies each fix by hand and records the outcome against the finding, so the report you regenerate afterwards shows what was resolved and what was not. Additional re-test rounds are available at a fixed day rate.
Can I see a sample report before committing?
Ask and we will send you a redacted one. We do not publish client reports on the website, redacted or otherwise - a client’s report is theirs, and a firm that publishes one has told you what it would do with yours. What is on the site is the format: one finding with every field it carries, why each field is there, the methodologies we work to and the questions we ask before quoting.
What if you find nothing critical - did I waste my money?
It is not wasted money, and it is worth being precise about what you have bought. You have a dated report naming exactly what was tested, the methodology it followed and what was found - which is the evidence a customer security review or an auditor asks for, and it is equally valid when the answer is "nothing serious". What it is not is a certificate: a test establishes that these things were examined in this window, not that no weakness exists. In practice a first engagement against an application that has never been tested rarely comes back empty.
Scope your VAPT engagement.
Thirty minutes on a call and you have a fixed price, a testing date and a walkthrough of the platform against your own scope.