Penetration Testing
The most common question we get before a scoping call is some version of: "just tell me what a penetration test costs." The honest answer is that it depends on what you're testing and how deeply but the ranges are predictable, the variables are well-understood, and
Red Teaming
The question comes up constantly when a CISO has done several rounds of penetration testing and starts wondering whether they're getting diminishing returns. The answer is that penetration testing and red teaming are not competing services they measure different things, serve different purposes, and the data on when
ISO 27001
ISO 27001 doesn't spell out "conduct a penetration test." What it does require is a structured programme of security evaluation that, in practice, auditors universally expect a pentest to satisfy. If your certification audit is approaching and you're uncertain whether a vulnerability scan is
Mobile App Penetration Testing
Most security teams assume their mobile app was covered in the web app pentest. It wasn't. The API calls, yes. The backend logic, partially. But the binary sitting on your users' devices the local storage, the hardcoded secrets, the certificate pinning that a tester bypasses in 60
Compliance
The Netherlands, a hub of innovative SaaS startups, is experiencing a rapid rise in digital threats. According to the Dutch Data Protection Authority, there were 37,839 data breach notifications in 2024, with cybercrime-related incidents climbing sharply. Across Europe, more than 130,000 breaches were reported, and the Netherlands alone
API Security
APIs are where modern applications actually live and where most of the significant security vulnerabilities are found. A web application pentest that doesn't explicitly include your API surface isn't testing the majority of your attack surface. It's testing the interface in front of it.
OWASP Top 10
Last verified: March 2026 The current OWASP Top 10 version is the 2021 edition. OWASP has not released a new Top 10 for web applications since 2021. If you've been told your web application pentest should be "OWASP-aligned" and almost every RFP says this you probably
Web App Penetration Testing
If you're evaluating web application penetration testing providers, you've probably already realised that the market is full of firms offering "pentests" that aren't really pentests automated scanner runs dressed up with a cover report. This guide is written for the people making
SOC 2
A SOC 2 penetration test typically costs between $8,000 and $25,000 for a standard SaaS scope web application, API layer, and cloud infrastructure. What puts you at the low or high end of that range depends on four variables: scope size, testing depth, report format, and whether retesting
TX-RAMP
TX-RAMP (Texas Risk and Authorization Management Program) is Texas's state-level cloud security certification framework. If you're a cloud service provider selling software or services to Texas state agencies, TX-RAMP authorization is not optional it's a legal requirement under Texas Government Code §2054.0593. Think
Assumed Breach Testing
What Is Assumed Breach Testing? Assumed breach testing is a type of penetration test that starts from the premise that an attacker has already gained access to your environment. Instead of testing whether someone can break in, it tests what they can do once they're inside — how far
HIPAA
Does HIPAA Require Annual Penetration Testing? Yes — effectively. HIPAA's Security Rule (45 CFR §164.308(a)(8)) requires covered entities and business associates to perform "periodic" technical evaluations of security controls protecting ePHI. The regulation doesn't use the word "annual," but annual