A penetration test is an authorized, simulated attack by security specialists that proves which vulnerabilities are actually exploitable, followed by a report with evidence, risk ratings and concrete fixes.
Our penetration testing services cover web apps, APIs and cloud. Our own instruments do the recon, replay and triage; a tester does the thinking.
30-minute scoping call, no obligation.
What the film shows
THE STACK LAYER
A web application or API test in the Netherlands typically costs EUR 5,000 to 15,000, which at our rates buys four to ten tester days. Scanners cover the known patterns in minutes, so those days should go where scanners cannot follow: authorization between users and tenants, business logic, and the chains of small issues that add up to one real risk.1
COVERAGE
Every category is one row in our test plan. The scoping call moves categories in or out; the report says which ran.
| Framework | ||
|---|---|---|
| OWASP WSTG categories12 categories / ids WSTG-INFO to WSTG-APIT | 12 of 12 in the package
| 1 of 12 in the package
|
| OWASP API Security Top 10 (2023)10 categories / ids API1:2023 to API10:2023 | 10 of 10 in the package
| 1 of 10 in the package
|
| Cloud and infrastructure12 categories | 0 of 12 in the package
| 9 of 12 in the package
|
Mapped to OWASP Web Security Testing Guide 4.2 and OWASP API Security Top 10 2023; the cloud and infrastructure categories follow our own test catalogue.
HOW WE TEST
Our instruments take the work a machine does well, at machine pace. The tester keeps every decision about what to test, what it means and what goes in your report. Severity is rated in CVSS v4.0, and every stack finding comes with the exact requests that reproduce it. Read the method.2
| Our instruments do | The tester does |
|---|---|
| Asset discovery and recon correlation | The threat model: what an attacker would want from you |
| Crawling, traffic capture and replay | Decides what deserves hours and what does not |
| Test cases at volume | Business logic, authorization models and multi-step abuse |
| Response triage and deduplication | Connects small issues into one real risk |
| First-draft report formatting | Severity, fix guidance and every word you read |
| Replaying every finding at retest | Confirms the fix closes the cause, not the symptom |
ENGAGEMENT
The same eight steps for every test, AI or stack. Dates go in the rules of engagement before anything starts.
30 minutes on what you ship, what matters and what stays out of scope.
One price for the agreed scope, after the call.
Written authorization, test windows, named contacts on both sides and how to stop the test. Read the rules.
4 to 10 testing days, fixed on the call.
Reported to your named contact before the report.
Findings with evidence, severity and fixes, and a one-page letter you can share.
We replay every finding after you fix it and update the report.
PACKAGES
The web app and its API first, because that is where users meet. Every range covers the testing days, the report and the letter.
Web applications and the REST or GraphQL APIs behind them.
COVERS
AWS, Azure or GCP accounts and the hosts you expose.
COVERS
Automated tests sell from about EUR 1,250 to 3,500 and are good at the known patterns. A human-led test spends its days on business logic, on what one user can do to another, and on the chains of small issues that add up to one real risk: the findings an automated run cannot reason its way to.3
SAMPLE FINDING
Finding F-01 of our sample report, word for word: a fictional insurer, the real format. Summary level only, with the fix.
F-01CRITICALCVSS-B 9.3API1:2023STACK LAYER
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N4FROM THE READING ROOM
Web application, API and cloud penetration tests, sold as Stack Pentest in two packages: Web and API, and Cloud and Infrastructure. If your product ships an AI feature on top, Launch Clearance tests the feature and the platform under it in one scope, with one report that also covers the paths between them.
Grey box, in most cases. With test accounts in two tenants and your API documentation, a tester spends the days on authorization and business logic instead of guessing at the surface. Black box shows what an outsider can find unaided, which suits a review of your external attack surface. We advise per scope on the call.
Yes. Our own instruments handle recon, traffic replay, response triage and the first draft of the report. A person decides what to test, works through the business logic and judges every finding. The tooling gives the tester more hours for the parts that need thinking; it never decides what goes into your report.
You share credentials through a channel agreed in the rules of engagement, never by email or chat, and we prefer dedicated test accounts you can switch off afterwards. The rules of engagement also record which systems, accounts and data are in scope, who may access them on our side, and how long anything we receive is kept.
Usually 4 to 10 testing days for a web application and its API, depending on the number of roles, tenants and integrations. Cloud and infrastructure tests are scoped per account. The scoping call fixes the number of days before you receive a quote, and the report follows the last test day with every finding and its fix.
A scope list, two test accounts per role in two separate tenants, API documentation if you have it, and a signed authorization naming the systems and the test window. Tell your hosting provider and any security monitoring team about the window, and name a contact who can stop the test at any time.
Launch Clearance is one scope for the feature and the platform under it, including the issues that only show up when both layers are tested together.
SAAS + AI FEATURE
EUR 10,000 to 20,000
30-minute scoping call, no obligation.