Single assessment
A defined application, a defined test window and a fixed quotation. Includes the written report and one retest within 30 days. This is where most teams start.
Suited to: a specific release, or assurance before an audit
Services
Security testing services
Each service is scoped and quoted on its own, with a written methodology. Nothing is bundled by default, and we do not quote until we understand what we are testing.
01
Web application penetration testing
Authenticated and unauthenticated testing of your web application and its APIs. We cover the OWASP Top 10, and spend most of our time on the issues automated scanners consistently miss.
Testing is manual first. We use tooling to widen coverage and for fuzzing, never to write the report.
- Typical duration
- 5–7 business days for one application with two or three user roles
- Suited to
- Customer-facing web applications, SaaS platforms and their APIs
What we test
- Access to data and actions across every user role and customer account
- Multi-step workflows such as onboarding, checkout and approvals, including steps that are skipped, repeated or run at the same time
- Sign-in, session management and account recovery
- Handling of user input, file uploads and connections to internal or third-party systems
What you receive
- Every finding verified, with full HTTP reproduction steps
- Remediation guidance specific to your stack
- A retest within 30 days and a signed closure summary
02
Pre-launch security review
For an application approaching go-live. The aim is not a long list of findings. It is to make sure you launch without the kind of architectural flaw that is cheap to fix now and expensive to fix later.
- Suited to
- New products and major releases a few weeks from launch
What we review
- A deployment threat model, including third-party dependencies
- Server, TLS, DNS and cloud IAM configuration
- Secrets handling, environment separation and the CI/CD pipeline
What you receive
- A pre-launch sign-off document for management and investors
- Confirmation that fixes hold before real customer data arrives
03
Attack-surface monitoring
Most organisations cannot reliably list everything they expose to the internet. We maintain that inventory for you and tell you when it changes, because the forgotten staging server is often the one that gets compromised.
- Format
- A continuous service, running in the background
- Suited to
- Organisations with many domains, environments or teams
What is included
- Subdomain and host discovery across your registered domains
- Analysis of JavaScript bundles for exposed keys, tokens and endpoints
- Detection of forgotten staging, demo and legacy services
- Alerts when newly exposed assets appear
04
Mobile application assessment
Android testing that combines static analysis of the shipped package with runtime instrumentation on a real device. What the decompiled code suggests and what the app does at runtime are often different, so we look at both, along with the API behind the app.
- Typical duration
- 10–14 business days for an app with a complex backend API
- Suited to
- Android apps that handle accounts, payments or personal data
What we test
- Runtime behaviour, using Frida instrumentation and traffic interception
- Certificate pinning and how well it resists bypass
- Local storage, keystore use and handling of sensitive data
- Deep links, exported components and inter-process communication
- The REST or GraphQL API the app depends on
05
Remediation support and retest
Finding a vulnerability is half the job. This covers getting it fixed properly, and showing your stakeholders, customers and auditors that it has been.
- Retest window
- Within 30 days of the report, at no extra charge
- Suited to
- Teams that need evidence of remediation for customers or auditors
What is included
- Direct support for your developers while fixes are written
- A retest of every finding within 30 days
- A signed closure summary suitable for ISO 27001, SOC 2 or enterprise procurement reviews
06
Vulnerability disclosure support
If external researchers report security issues to you, we can triage those reports on your behalf: reproduce them, rate them accurately and help you respond well.
- Suited to
- Companies that receive reports through a security contact or a disclosure programme
What is included
- Technical reproduction and severity calibration on the P1–P5 scale
- Filtering of spam, duplicates and out-of-scope claims
- Support with coordinated disclosure and safe-harbour wording
Severity ratings
How we rate findings
We use the five-level P1–P5 scale common to coordinated disclosure programmes, so our findings fit the triage process your team already runs.
| Rating | Typical examples | When you hear about it |
|---|---|---|
| P1 · Critical | Access to other customers' data, remote code execution, takeover of accounts or tenants | Within 24 hours |
| P2 · High | Authentication or authorisation bypass, stored XSS in authenticated areas, SSRF reaching internal services or cloud metadata, privilege escalation | Within 48 hours |
| P3 · Medium | Reflected XSS, CSRF on sensitive actions, weaknesses in session handling | In the report |
| P4 · Low | Issues with limited impact, or that depend on unlikely conditions | In the report |
| P5 · Informational | Hardening recommendations without a direct, exploitable impact | In the report |
Ways to engage
Choose the cadence that fits how you ship
Release-cycle testing
Testing tied to your release cadence. Each significant release is assessed before it reaches production, against a standing scope that grows with your product.
Suited to: teams that ship frequently
Continuous programme
Attack-surface monitoring throughout the year, quarterly penetration tests, and remediation support by email or Slack in between.
Suited to: organisations that need continuous coverage
Not sure which service you need?
Describe your application and what you need assurance on. We will recommend a scope, explain why, and send a fixed quotation, usually within one business day.
Request a proposal
Or email enquiries@hebtech.in