Focused Web Application Penetration Test
Real manual penetration test of a single web application. Authenticated and unauthenticated testing, manual exploitation, ISO 27001 Annex A.8.29 ready.
Quick Answer
Real manual penetration test of a single web application. Authenticated and unauthenticated testing. Manual exploitation of all findings within Rules of Engagement. Tested against OWASP ASVS 5.0.0 Level 2 by default (Level 1 or Level 3 on request); the report and Attestation Letter name the exact ASVS version and level tested. OWASP WSTG v4.2 methodology, OWASP Top 10:2025 and OWASP API Security Top 10 (2023) coverage. CVSS v4.0 scoring with CWE classification. Signed Attestation Letter accepted as evidence for ISO 27001 Annex A.8.29, SOC 2 CC4.1, and most enterprise vendor security reviews. 3-5 person-days. Delivered in 1.5-2 weeks. From €1,800.
Why You Need This
This is the minimum scope under which we will deliver work labelled "penetration test" and stand behind the deliverable in front of an enterprise security team or an ISO 27001 auditor.
Most SaaS startups and small B2B platforms don't need an Enterprise-tier engagement. They need a real, focused penetration test of their core application - sufficient evidence for ISO 27001 Annex A.8.29 audit, SOC 2 CC4.1/CC7.1 evidence, enterprise prospect vendor security review, cyber insurance underwriter requirement, and annual security re-validation.
Who Requires This From You
- ISO/IEC 27001:2022 Annex A.8.29 - Security testing in development and acceptance
- SOC 2 Trust Services Criteria - CC4.1, CC7.1, CC7.2
- Enterprise vendor security questionnaires requiring "penetration test" (not "vulnerability assessment")
- Cyber insurance underwriters - AIG, Hiscox, Beazley, Chubb, Travelers standard questionnaires
- GDPR Article 32 (1)(d) - Process for regularly testing security measures
- PCI DSS v4.0.1 Requirement 11.4.1 - At least annually and after significant changes
What You Get
Testing scope (one web application end-to-end)
- Authenticated testing with provided test accounts (multiple roles where applicable)
- Unauthenticated testing of public attack surface
- Manual exploitation of all findings where safely possible within Rules of Engagement
- OWASP WSTG v4.2 operational basis - full test case coverage
- Verified against OWASP ASVS 5.0.0 Level 2 by default (Level 1 or Level 3 on request; ASVS v4.0.3 on request for legacy compliance frameworks)
- OWASP Top 10:2025 and OWASP API Security Top 10 (2023) coverage
- Authentication and session management testing
- Authorisation enforcement testing
- Server-side and client-side injection testing
- Business logic flaws (where applicable to scope)
- Cryptographic implementation review
Deliverables
- Formal penetration test report (typically 15-25 pages)
- Executive summary, methodology, findings with CVSS v4.0 vectors and CWE classification
- Reproducible proof-of-concept evidence
- Remediation guidance per finding
- Signed Attestation Letter suitable for audit evidence file and vendor security file
- Report and Attestation Letter name the exact ASVS version and level tested (e.g. "OWASP ASVS 5.0.0, Level 2")
- Testing can be performed on staging environments with synthetic data
- One round of clarification questions included
- Critical finding escalation within 4 hours of validation
Add-on options
- Remediation retest within 30 days (+€500) - the attestation then covers the initial test and the retest and reflects the status after retest
- Additional clarification rounds (+€200/round)
- Auditor handover session (30 min) (+€200)
- Follow-up Q&A with end-customer's security team (+€300)
What Happens If You Don't
Our Process
Reviewed by
Is This the Right Penetration Test for You?
You should choose this tier if…
- You have a single web application to test (not a full platform)
- You need ISO 27001 Annex A.8.29 evidence specifically
- Your cyber insurance underwriter requires a recent pentest
- You're preparing for first enterprise vendor security review
- Your SMB budget is limited and you need a published starting price and a fixed quote after scoping
- You need real manual exploitation, not just automated scanning
Typical situations
We just signed our first enterprise deal, and their procurement team requires a recent pentest as a condition of contract.
Our auditor said we need pentest evidence for A.8.29. What's the smallest scope that works?
Our cyber insurance renewal application was declined for insufficient security evidence. We need proper pentest evidence.
We're preparing for DORA general resilience testing. What's the entry-level pentest?
Scope and pricing
Our €1,800 Focused Pentest is designed for a single web application that needs ISO 27001, cyber insurance or enterprise-procurement evidence on a defined budget.
Why from €1,800? The price is published, and the final fixed price is confirmed in writing after a short scoping call. We test to the OWASP WSTG v4.2 methodology, score findings with CVSS v4.0, and issue a signed Attestation Letter, working from our Moldova IT Park base where operating costs are lower than in London or Munich. See our Pentest prices across Europe 2026 guide for published prices from other providers.
Note: We are not CREST-accredited (Moldova has no CREST accreditation path). If your requirement specifically requires CREST (typically UK public sector), we can refer partner firms.
When to choose a different tier instead
| Signal | Recommended service |
|---|---|
| Only need baseline evidence (ISO 27001 A.8.8) | VA (€539) |
| Multi-tenant SaaS with REST API | Standard Pentest (€4,500) |
| Need remediation retest included | Standard Pentest (€4,500) |
| Web + mobile app testing needed | Standard Pentest + Mobile add-on |
Frequently asked questions about this tier
Is this 'real' penetration testing or just automated scanning?
Real manual penetration testing. Automated tools (Burp Suite Professional, Nuclei) are used to find candidate vulnerabilities, but every finding is manually validated and exploited where safely possible. Approximately 30% of our findings are manual-only (business logic flaws, authorisation issues, session management).
What OWASP coverage do I get?
Full OWASP WSTG v4.2 methodology. OWASP Top 10:2025 categories covered. If you have an API, upgrade to Standard Pentest (€4,500) for OWASP API Security Top 10 (2023) coverage.
Will my auditor / customer accept the report?
For most commercial and compliance purposes, yes. Our Attestation Letter covers ISO 27001:2022 Annex A.8.29, SOC 2 CC4.1/CC7.1, cyber insurance underwriter submission (AIG, Hiscox, Beazley, Chubb, Travelers), enterprise vendor security review responses, and GDPR Article 32 depth testing.
How do you test if my app has SSO / OAuth?
SSO / OAuth integration testing is part of the standard scope. We test auth flow security, token handling, session fixation, and account takeover paths.
Do you sign an NDA?
Yes. Mutual NDA signed before any technical disclosure. English law, London courts jurisdiction available for UK clients.
Pricing & Delivery
From €1,800 for a small, single-purpose web application. Up to €2,500 for a more complex single application with multiple user roles, integrated payment, file uploads, or moderate API surface. Exact figure confirmed in Statement of Work after scoping call.
Last reviewed: 3 November 2026
Frequently Asked Questions
What's the difference between this and the €539 Vulnerability Assessment?
Vulnerability Assessment is automated scanning with manual validation of high-severity findings only. Focused Pentest is a real manual penetration test - every finding is exploited where safe, business logic flaws are tested, authorisation is challenged, and the Attestation Letter explicitly identifies the work as penetration test. If your auditor or prospect specifically requires "penetration test" rather than "vulnerability assessment", choose this tier.
Will this satisfy an ISO 27001 audit?
For Annex A.8.29 (Security testing) with a single in-scope application - typically yes, provided the application matches your ISMS scope. If your ISMS scope includes multiple distinct applications, separate APIs, or specific cloud infrastructure, additional testing may be needed. We recommend confirming your ISMS scope with your auditor before engagement.
Is remediation retest included?
Not by default at this tier (it's a +€500 add-on). Remediation retest is included as standard in our Standard tier (€4,500+) and above. Tier 2 is designed for budget-conscious engagements where retest can be optional.
Can your report be shared with our enterprise customer?
Yes. The Attestation Letter is designed to be extractable as a standalone document for inclusion in your customer's vendor security file. Full report can be shared under standard confidentiality terms.
How quickly can you start?
Subject to current engagement load, typically 3-4 weeks after Statement of Work signature. For compliance-deadline-driven engagements, faster starts may be possible - please indicate urgency in your scoping request.
Do you sign DPAs?
Yes. UK GDPR-compliant DPAs and EU Standard Contractual Clauses are available. We are a GDPR processor for all client engagements.
Are you CREST-accredited?
No - we're not CREST-accredited. Moldova has no CREST accreditation pathway, so it's a jurisdiction limitation rather than a capability gap. Even though we're not CREST-accredited, the Focused Pentest follows the same OWASP-aligned methodology CREST-accredited testers use, with WSTG v4.2 coverage, CVSS v4.0 scoring and CWE classification, closing with a signed Attestation Letter your auditor can reference. Because we're not CREST-accredited, if a UK public-sector requirement specifically names CREST membership, tell us before we scope the engagement and we'll refer you to an accredited partner firm.
Related Services
Comparing providers? Check an existing pentest quote against published prices. Testing for an auditor or a compliance platform? See pentests for SOC 2, ISO 27001 and PCI DSS. Wondering about a mobile app? Read what Apple and Google actually require.