Skip to content
CYRENTIQ
All servicesCybersecurity testing

Web & API Penetration Testing

Find out whether someone could break into your website or connected systems, through a controlled test you approve.

What this helps you decide

Which attack paths need attention before launch, a customer review or the next release?

When you need it

A new application, an enterprise security review or a major release. Validate how authentication, access controls and business logic stand up to realistic attacks.

Business impact & an example

A working login page does not prove customer records are protected. Weak access controls can expose information across accounts or allow actions a user should not be able to perform.

A question worth asking

Could a normal customer access another customer’s information or use a feature reserved for administrators?

Examples guide the scope; they are not promised findings.

What’s included & what you receive

Agreed coverage

  • Agreed web application and API attack surface
  • Authenticated roles and authorisation boundaries
  • Manual validation of exploitable weaknesses
  • Risk-ranked findings and remediation walkthrough
  • Guided by OWASP testing guidance, including the OWASP Top 10 and API Security Top 10

Your deliverables

  • Executive summary of business exposure
  • Technical evidence and reproduction steps
  • Prioritised remediation plan
  • Retest scope and window agreed in the proposal
Exclusions & limitations

Denial-of-service, social engineering, unapproved targets and continuous monitoring are excluded unless separately agreed.

References to standards are not claims of certification, accreditation or endorsement.

How it works

  1. 01

    Initial conversation

    Tell us what you want to achieve and which systems are involved. You do not need to know the technical details.

  2. 02

    Initial assessment

    We review your situation and confirm a sensible scope. The initial assessment is completed within 3–5 business days.

  3. 03

    Written proposal

    You receive a proposal setting out the scope, deliverables, fees (AUD, ex GST), timing and exclusions. Testing only starts with written approval from the system owner and agreed testing windows and stop conditions.

  4. 04

    Delivery

    We carry out the agreed work, with one point of contact and specialist practitioners matched to your scope.

  5. 05

    Findings and next steps

    We walk you through the results and priorities, and any follow-up or re-checks agreed in your proposal.

Frequently asked questions

How much does Web & API Penetration Testing cost?

Tailored to your scope – quoted after your initial assessment (AUD, ex GST). The final fee is confirmed in a written proposal before any work begins.

How long does it take?

The initial assessment is completed within 3–5 business days. The project timeframe depends on your scope and is confirmed in your proposal.

What do you need from us?

Testing authority: Written approval required before any testing. Retesting: Allowance and window agreed in scope.

Will testing disrupt our systems?

No security or load testing begins without written approval from the system owner and agreed rules, targets, testing windows, escalation contacts and stop conditions. Only the agreed systems and activities are included.

Do you work outside Gippsland?

Yes. We are based in Leongatha, Gippsland, and work with businesses across Australia.

Related services

TEAM CREDENTIALS

Expertise behind the testing.

Certifications held across our team cover penetration testing and red team techniques. Specialist practitioners are matched to your agreed scope.

OSEPOSCPCRTOCRTECRTPECPPTv2eJPT
View certification names
OSEP
Offensive Security Experienced Penetration Tester
OSCP
Offensive Security Certified Professional
CRTO
Certified Red Team Operator
CRTE
Certified Red Team Expert
CRTP
Certified Red Team Professional
ECPPTv2
eLearnSecurity Certified Professional Penetration Tester
eJPT
eLearnSecurity Junior Penetration Tester

These are individual team-member credentials, not company certifications. Not every team member holds every credential.

Technical words, explained simply
Cybersecurity
Protecting your information, accounts and systems from misuse.
Compliance
Showing how you meet the standards or requirements that apply to your organisation.
Penetration test
An authorised attempt to find and demonstrate security weaknesses.
API
A connection that lets two software systems exchange information.
QA and regression testing
Checking that software works and that changes have not broken existing features.
MFA
An extra sign-in check, such as an approval on your phone, alongside your password.
AI governance
Rules for choosing and using artificial intelligence safely and responsibly.
Backup
A separate copy of your files and systems you can restore if something goes wrong.
Threat detection
Tools and people that watch for signs of an attack and respond quickly.
Scope
Exactly what work is included, what is excluded and what you will receive.