Find the holes before someone else does.
Cognivus tests your web application and APIs for security weaknesses using automated scanning backed by manual verification, following the OWASP Web Security Testing Guide. You receive a clear report ranked by severity, with evidence and fixes, and a free retest once you have made the changes. We only ever test systems you authorise in writing.
What we test
- Your web application and its APIs
- Authentication, sessions and access control between user roles
- Common web weaknesses from the OWASP Top 10
- Known-vulnerable dependencies and secrets left in code
- Cloud and server configuration within the agreed scope
How an engagement runs
- Written scope and authorisation. We agree exactly which systems, when, and from where, and you sign an authorisation covering every target. Testing without it is unlawful, so this always comes first.
- Testing. Automated tools surface likely weaknesses; we then verify each one by hand so the report contains real issues, not scanner noise. If we find something critical, we stop and contact you at once.
- Report. Each finding with a severity rating, evidence, business impact and a concrete fix.
- Retest. After you fix, we re-check and issue a retest confirmation.
Pre-launch testing
Launching something new? We run the same testing on a staging copy before go-live, so the launch-blocking issues are found and fixed first, using test data only.
Frequently asked questions
Is this a full manual penetration test?
We lead with automated scanning and verify findings manually, which suits most SaaS products. For a deep manual penetration test against a specific threat, or a CERT-In empanelled test required by a regulator, we scope that separately and tell you plainly what is and is not included.
Do you need written permission?
Always. We test only systems you authorise in writing, within an agreed scope and window, and we never test infrastructure you only rent, such as a hosted website builder.
Will testing break anything?
We test carefully and avoid anything disruptive such as denial-of-service. If anything looks risky we pause and check with you first. Where possible we test a staging copy.
What happens to the findings?
They are confidential. We handle the report and evidence securely and delete them on the schedule your contract sets.
Have a product to build or a system to secure?
Tell us what you need. You will receive a written proposal within one business day.