Service · Testing and QA

Penetration testing

Our job is to spot the weaknesses before a real attacker does. Everything follows agreed rules of engagement, a fixed time window and a no-damage policy. Think of it as a controlled exercise rather than a break-in, with documentation that also supports your NIS2 and GDPR obligations.

Send an enquiry See the scope

Permission

written and in advance

Non-destructive

safe techniques only

Priorities

what to fix first

Retest

after your fixes

What the service covers

Effort goes where real attacks go: sign-in, permissions, user input and third-party code, guided by the OWASP methodology.

Talk it through with us

Authentication

Bypassing sign-in, guessable passwords, a weak reset flow, session expiry and the configuration of MFA or MitID login.

Access control

Swap one ID in a URL and see another customer's invoice? That broken-authorisation flaw tops our findings year after year.

Input

SQL injection, cross-site scripting and uploading harmful files.

Dependencies

Packages carrying published CVEs. Typical projects pull in dozens of them.

Configuration

Admin panels open to the internet, debug output enabled, absent security headers, stray backup files.

Report

Each finding rated for severity, with proof and a fix recommendation, plus an executive summary.

How we deliver it

An average web app needs one to two weeks, report included. All work is remote, from fixed IP addresses you can allow-list.

Agreement

Signed authorisation, scope, time window and an emergency contact on both sides.

Reconnaissance

Mapping entry points, frameworks and publicly reachable APIs.

Testing

Hands-on and automated techniques in a low-impact mode that will not disturb your users.

Report and retest

Ranked findings, followed by verification once your team has deployed fixes.

Never forward a vulnerability report casually. It is a step-by-step manual for exploiting your system, and until remediation is done it is riskier than the flaws it lists. We hand it over through an encrypted channel to a named, limited audience.

Common questions

Provided the system owner authorises it in writing, yes. Our contract fixes the scope and dates, and we do not touch systems we have no permission for. Where a third party hosts the application, we get their approval too.

Our techniques are chosen to avoid damage, yet no test is entirely risk-free. A staging copy is the safer target; on production we insist on an agreed window and a recent backup.

Scanners compare responses with signatures and excel at flagging outdated libraries. Business-logic holes, like viewing other users' records or skipping a payment step, take human reasoning. Good testing uses both.

Annually as a minimum, plus after significant changes. If NIS2 applies to you, recurring tests fit naturally into your risk management.

Related services

View the whole area

Service Functional testing Every user journey checked before release Service Load testing How your system copes when everyone arrives at once Service Test automation Automated tests for the checks you repeat Service Usability testing Real users reveal where the interface trips them up

Let us find the gaps

Tell us about the application and whether a staging copy exists. We then fix the scope together and run the test.

Email
office@apply.dk

Coverage
All of Denmark, delivered remotely

I agree that Apply may handle my details as set out in the privacy policy