Web Application Vulnerability Assessment

A vulnerability assessment identifies known weaknesses using automated scanning, with manual validation of the high-severity findings. A penetration test goes further: it actively exploits weaknesses to prove impact, tests business logic and chains issues together. VA is breadth-first; a pentest is depth-first. Our VA is €539 fixed; our penetration tests start at €1,800.

No. This is a Vulnerability Assessment, and the Attestation Letter says so explicitly. We label it honestly because the difference matters in audit and procurement. If your requirement names a "penetration test", choose our Focused Pentest (from €1,800) instead.

It depends on the control. For ISO 27001 Annex A.8.8 (management of technical vulnerabilities), a VA is typically accepted. For Annex A.8.29 (security testing in development and acceptance), it is auditor-dependent, and many auditors expect a penetration test. Confirm with your auditor before you buy, or ask us and we'll help you read the requirement.

No. The €539 tier covers the public, unauthenticated attack surface of one web application, so no test accounts are needed. For testing behind the login across multiple roles, choose the Focused Pentest (from €1,800).

Burp Suite Professional, Nuclei with regularly updated templates, OWASP ZAP, and Subfinder with httpx for asset discovery, plus our own custom checks. Every Critical and High finding is validated manually by a senior engineer before it goes into the report.

Subscription scanners give continuous, automated coverage and are valuable between periodic tests. Their output is raw scanner data, false positives included, with no signed deliverable an auditor recognises. Here a senior engineer validates every Critical and High finding, and you receive a structured report and a signed Attestation Letter. Most compliance programmes use both: a scanner for continuous monitoring, and an independent assessment as the periodic, audit-grade checkpoint.

We report it to your nominated contact within 4 hours of validation, over a secure channel, with reproduction steps and immediate remediation guidance. We don't wait for the report delivery date.

You still receive the full report and a signed Attestation Letter. A clean result is a valid outcome: for an auditor, evidence that testing was done and found no critical exposure is exactly what the control asks for.

9-10 business days from order. The NDA and intake happen on day 1, active assessment on days 2-4, and the report and Attestation Letter are delivered on day 9, five business days after testing ends.

The letter is signed by the senior engineer accountable for this service line (see "Reviewed by" on this page). It states the scope tested, dates, methodology and remediation status. If an auditor or insurer may reject it, tell us before the engagement starts. Rejections usually come from a mismatch between controls, for example a requirement that specifically names a penetration test, not from the letter itself. We'll confirm fit with your requirement in advance.

Scope and Rules of Engagement are signed before testing, including the environment in scope, testing windows and an emergency contact who can pause testing immediately. Automated scanning is throttled to avoid denial-of-service side effects. We prefer to test a staging environment where one exists and matches production.

Yes, under a mutual NDA. Email info@optimum-web.com with your company name. We send the NDA the same business day, followed by an anonymised sample report.

No. PCI DSS requires quarterly external scans by an Approved Scanning Vendor (ASV) and, separately, penetration testing under requirement 11.4. This assessment can be useful preparation, but it does not replace either.

No. Moldova has no CREST accreditation pathway, so this reflects jurisdiction, not capability. Our methodology uses the same building blocks CREST-accredited firms use: checks drawn from the OWASP Web Security Testing Guide (WSTG v4.2) that apply to an unauthenticated surface, CVSS v4.0 scoring with CWE classification, and a signed Attestation Letter. If your procurement policy requires CREST membership (most often UK public sector), tell us on the first call and we'll refer you to a partner firm rather than start a scope we can't contract.