Automated vulnerability scanners search for known signatures and common misconfigurations quickly. They are useful for initial triage but routinely miss business logic vulnerabilities, authentication bypass chains, IDOR flaws, and application-specific abuse cases. Manual penetration testing, as performed by IVASTA's engineers, simulates how a skilled human attacker approaches your application, following logical paths, chaining weaknesses, and applying creative reasoning that no scanner can replicate.

The duration depends on the size and complexity of the application. A focused assessment of a single-feature web application may take 3–5 days. A large, multi-role SaaS platform with complex workflows, multiple API surfaces, and authenticated roles may require 2–3 weeks. During scoping, IVASTA will provide a fixed timeline based on your specific application. We do not commence testing until the scope and timeline are agreed in writing.

Pricing is scoped to your engagement and depends on the application's size, complexity, number of roles, API coverage, and testing mode (black box, grey box, or white box). Rather than publish a generic price list, we prefer to scope each engagement accurately and provide a fixed-price quote, so you know exactly what you are paying for. Contact us for a scoping call and we will provide a quote within 24 hours.

While SOC 2 does not mandate penetration testing by name, the AICPA's Trust Services Criteria (particularly CC6 and CC7) require organisations to demonstrate ongoing testing and monitoring of security controls. In practice, independent penetration testing is the most widely accepted evidence for these controls during a Type II audit. If you are working with an auditor or preparing for a SOC 2 certification, IVASTA's report format is structured to align with these requirements.

Yes. PCI DSS Requirement 11.4 explicitly requires penetration testing of all in-scope systems at least annually and after significant changes. Both internal and external testing is required, covering both network and application layers. IVASTA's PCI DSS penetration testing engagements are scoped to satisfy these requirements and are structured to produce a report your QSA will accept.

GDPR Article 32 requires organisations to implement technical measures to ensure the ongoing confidentiality and integrity of personal data processing systems, and to regularly test and evaluate those measures. A documented web application penetration test provides written evidence that you have proactively assessed your application for vulnerabilities that could lead to a personal data breach. In the event of an incident or regulatory investigation, this evidence demonstrates that your organisation took its security obligations seriously.

After the assessment, you receive a full technical report and an executive summary. Our team will walk you through the findings in a debrief call. Once your team has remediated the identified vulnerabilities, IVASTA performs a free retest to confirm the fixes are effective. Upon successful completion, we issue a signed security attestation letter confirming the assessment.

This depends on the testing mode you select. For grey box testing (our most common engagement type), you typically need to provide: the application URL, test account credentials for each user role, a brief description of core functionality and any known sensitive areas, and written confirmation of scope and authorisation. We handle the rest from there.

IVASTA conducts testing in a controlled manner to avoid disrupting live services. We discuss testing windows and any restrictions during scoping, if you have specific availability requirements (for example, avoiding peak trading hours), these are built into the engagement plan. For production environments, we avoid destructive testing unless explicitly authorised. Wherever possible, we recommend using a staging environment that mirrors production closely.