An threat model will be created to explore assets, threats, attack vectors and conditions required for successful attack. To perform this, our experts will investigate the architecture of the applications, the involved technology as well as the key security requirements and threats. This step might involve techical meetings and discutions with key personnel from the customer’s staff.

The next step involves reviewing threat model results performed by our certified penetration testers and generate test scenarios to cover possible threats. The test scenarios custom to your web application’s specifics will be combined together with OWASP’s testing methodology to generate a test plan that will guide the attack and test execution process, ensuring every avenue of attack is thoroughly covered.

In the third step the actual attacks scenarios are performed, as they are described in the test plan resulting in one or more vulnerabilities that will be identified. All the identified vulnerabilities will be carefully documented, preserving evidence and describing necessary steps to reproduce them.

This is the final step of the assessment and one of the most important in the process. We believe that quality reporting of the identified vulnerabilities along with practical remediation recommendations ensures the project’s success. Also, the impact and severity scores associated with each vulnerability will be thoroughly explained from both management and technical perspectives.