You Don't Need to Test Everything, You Need to Test What Breaks the Business

A focused web application pentest is a real manual penetration test scoped to a single web application, covering authenticated and unauthenticated testing with manual exploitation of every finding within agreed Rules of Engagement, rather than an entire network and application estate. It starts from €1,800, runs 3 to 5 person-days, and delivers in 1.5 to 2 weeks, compared to two to four weeks or more for a full-scope engagement. Most companies delay pentesting entirely because they picture it as an expensive audit of everything they own. In practice, the highest-risk area is usually one specific application or flow, and testing that well beats waiting indefinitely for the budget to test everything.

Ask a founder or CTO why they haven't run a pentest yet, and the answer is rarely "we don't think it matters." It's almost always "we don't have the budget or the weeks it would take to test the whole platform." That framing is the problem. A full-scope engagement, covering external network, internal network, every application, and social engineering, genuinely does run into the tens of thousands and take weeks to schedule and execute. But most companies don't need that scope. They need one specific answer: can someone break into the part of our product that actually holds money or data.

Waiting for the budget or the calendar space for a full-scope test means the highest-risk flow in your product goes untested indefinitely. A focused test on that one flow, done properly, closes more real risk than an indefinitely postponed comprehensive one.

Three situations come up constantly, and in all three, scope discipline matters more than scope size.

Before a major enterprise sale. Enterprise procurement and security questionnaires increasingly ask for a recent pentest report as a condition of signing. You don't need to have tested your internal admin tooling from three years ago. You need current, credible evidence that your customer-facing application and its API have been tested.

After shipping a feature that touches money or personal data. A new checkout flow, a new payments integration, a new patient or financial data module. The rest of your platform hasn't changed. The new surface has, and it's the part an attacker would target first because it's new and less battle-tested.

Ahead of a funding round or acquisition due diligence. Investors and acquirers increasingly ask security questions during diligence. A focused pentest on your core product gives you a defensible answer without committing to a comprehensive engagement on a timeline that doesn't fit the deal.

A focused pentest is not a smaller, watered-down version of a full test. It's the same manual, expert-led methodology applied to a deliberately narrow target: one web application, rather than an entire network and application portfolio. Optimum Web's Focused Web App Pentest follows the OWASP WSTG v4.2 methodology, with coverage of OWASP Top 10:2025 and the OWASP API Security Top 10 (2023) where the application exposes an API. Every finding is manually exploited within agreed Rules of Engagement, not just flagged and left for the client to verify, and scored with CVSS v3.1 vectors plus CWE classification.

The scoping conversation defines exactly what's in bounds: which environment (staging or production), which user roles get tested (anonymous, standard user, admin), and which flows are the priority within the application. That conversation is where most of the value gets locked in. A well-scoped test on your authentication and payment flow will find more that matters than a rushed full-scope test that runs out of time before it gets past the login page.

If there's one finding to expect, it's this one. Broken Access Control has held the #1 spot on the OWASP Top 10 for four consecutive release cycles, and the 2025 edition found that 100% of tested applications contained some form of it. Separately, BreachLock's 2025 Intelligence Report found broken access control now accounts for 32% of all high-severity penetration test findings, a 40% surge over the prior year. It's the most common finding not because it's exotic but because it's easy to introduce and easy to miss in code review: a standard user modifying another user's record by changing an ID in an API request (IDOR), a regular account reaching an admin-only endpoint because the check only lives in the frontend, a password reset flow that never verifies the token belongs to the requesting account.

Automated scanners are structurally bad at finding this class of bug because it requires understanding what the application should do, not just what it technically allows. That's the gap manual testing exists to close, and it's exactly the kind of issue a focused test on your core authenticated flows is built to catch.

A full-scope pentest covers your entire network, all applications, and social engineering — typically costing €15,000–€50,000+ and taking two to four weeks or more to complete. It's the right choice for mature security programs with a large attack surface.

A focused web app pentest applies the same manual testing methodology to one application, at a fraction of the cost (from €1,800) and timeline (1.5–2 weeks, 3–5 person-days). It trades breadth for depth and speed. For startups, single-product companies, and teams needing pre-sale or pre-funding evidence, focused testing closes more real risk than an indefinitely delayed full-scope engagement.

If budget or time only allows one focused engagement, prioritize in this order:

1. Authentication and session management. Login, password reset, session handling. If this breaks, everything downstream is compromised regardless of how well the rest is built.

2. Anything that touches money. Checkout, billing, payment method changes, refunds. Business logic flaws here have direct financial impact.

3. Role-based access within the application. If different user roles (standard user, manager, admin) share the same application, this is where broken access control does the most damage. Applications serving multiple separate customer organizations on shared infrastructure need dedicated tenant isolation testing, which sits outside a single-application focused scope.

4. Any API exposed to third parties or partners. External-facing APIs are tested less often internally and are a common blind spot.

A focused engagement produces the same quality of deliverable as a larger one, scoped to the target: a full findings report with CVSS v3.1 scoring and CWE classification, evidence for each manually exploited finding, and remediation guidance your engineering team can act on directly. The engagement closes with a signed Attestation Letter accepted as evidence for ISO 27001 Annex A.8.29, SOC 2 CC4.1, and most enterprise vendor security reviews.