Pentest Services Explained: Matching the Test to Your Situation
Pentest services aren't one and all the same. This guide matches your situation, a new web app, a cloud migration, an AI feature, or a suspected internal risk, to the test or combination that fits. Scan the trigger table, read the scope notes for each service, then book a scoping call once you know what you need.
You know you need testing. What you're less sure about is which pentest services apply to your situation. Seven services, each with a different scope, and a business situation that doesn't map cleanly onto any single one of them. That's a normal place to get stuck, and it's the gap this guide fills.
This guide explains the scope of each of our penetration test offerings and then matches them to the scenarios where you’d need them. So you’ll be able to answer which service or combination, based on your situation, is worth a conversation.
What Each Penetration Test Covers (and Skips)
First it’s important to understand what’s typically included in the scope for each of our seven pentest services and what’s not.
Web Application Penetration Test
A Web Application Penetration Test focuses on the software your users interact with through their internet browsers. This assessment scrutinises your authentication mechanisms, session handling, data access controls, and the business logic behind them.
- In scope: The frontend interface, the backend APIs it calls, user roles and privilege separation, and business logic workflows. We look for injection flaws, broken access controls, and cross-site scripting.
- Out of scope: The operating system of the server hosting the application and the physical security of wherever it's hosted.
Mobile/Desktop App Penetration Test
When you ship software that installs directly onto user devices, the threat model changes significantly. A Mobile or Desktop App Penetration Test evaluates how your app behaves in potentially hostile local environments.
- In scope: Local data storage, inter-process communication, sensitive information leakage, certificate validation, binary protections, and how the app transmits data over the network.
- Out of scope: A complete test of the backend API that the application uses, as well as the larger corporate network that the device may connect to.
Cloud Audit
Cloud environments introduce unique risks that traditional network testing can’t address. A Cloud Audit focuses on how you configure and manage your cloud provider's services.
- In scope: Identity and Access Management (IAM) roles and permissions, storage bucket configuration, serverless function permissions, network segmentation, and service configuration across AWS, Azure, or GCP.
- Out of scope: The cloud provider's own physical infrastructure. Securing the underlying hardware and data centre is the responsibility of AWS, Azure, or GCP.
AI & LLM Security Testing
Adding artificial intelligence to your product introduces new attack vectors. An AI & LLM Penetration Test evaluates how your implementation handles malicious inputs specifically designed to manipulate the model.
- In scope: Prompt injection, both direct and indirect, data leakage, insecure output handling, excessive agency, and abuse of any tools or plugins the model can use.
- Out of scope: The underlying foundation model itself. We only test your implementation and how the AI component interacts with your systems, not how the model was trained.
Internal Penetration Test
An Internal Penetration Test simulates an attack coming from inside your corporate network. This models the threat posed by a rogue employee, a compromised workstation, or an attacker who has already hacked your perimeter defences.
- In scope: Internal servers, Active Directory, internal web app, network segmentation, and privilege escalation paths.
- Out of scope: Your public-facing websites and the physical security of your office.
The value of human judgement is unmatched in quality pentest services. It’s possible for a scanner to detect a small configuration error on a private network drive. However, an automated tool can’t connect the dots between this small issue and another apparently unrelated, low-severity access vulnerability. Our testers will find the connection and a direct path to administrative privileges.
External Penetration Test
Determined attackers and automated scripts are constantly probing your internet-facing perimeter. An External Penetration Test finds out what attackers can see and exploit from the outside.
- In scope: Exposed servers, firewalls, VPN endpoints, and public-facing services. We look for unpatched software, weak authentication on remote access, and information leakage.
- Out of scope: Internal network segments that are fully isolated from the internet.
Code Audit
A Code Audit is a source-level review, the deepest level of validation we offer, because it looks at the code itself rather than how the running system behaves.
- In scope: Cryptographic flaws, security vulnerabilities, hardcoded secrets, insecure logic, backdoors, and weak third-party dependencies.
- Out of scope: Live infrastructure configuration. A code audit is static analysis; it doesn't dynamically interact with a running server.
Match Your Situation to the Right Pentest Services
Before you book your free consultation call, this trigger table shows how real situations map to security testing services and when to combine them.
| Your Situation | Service(s) to Look At | Why |
| Launching a new customer portal or SaaS product | Web Application Penetration Test | Covers the login, sessions, and data access your users touch directly |
| Shipping a mobile app alongside a backend | Mobile/Desktop App Test + Web Application Test | The backend API needs its own test, not just the app calling it |
| Running in the cloud with a web app on top of it | Cloud Audit + Web Application Test | Infrastructure and applications are separate layers, each needs testing |
| Adding an AI feature, chatbot, or agent to your product | AI & LLM Security Testing | Covers prompt injection, data leakage, and tool abuse a standard test won't check |
| AI features inside a web app or a cloud environment | AI & LLM Security Testing + Web App or Cloud Audit | The model's own risks and the platform carrying it are different attack surfaces |
| Need to prove your security posture to regulators or new partners | Cloud Audit + Web App Test + Internal Pentesting | Combines IAM roles, storage exposure, misconfigurations, app-layer testing, and internal security measures |
| Want the full picture, not just the outside or the inside alone | Internal Penetration Test + External Penetration Test | Perimeter and interior get tested separately, then read together |
| Custom software going into production that handles sensitive data | Code Audit + Web Application Test | Static review of the code, dynamic testing of the running system |
| Recovering from a breach and need to know how it happened | Incident Management (a separate offering) | Reviews logs and code to find root cause, then hardens against repeat |
A Dedicated Response Service
Breach recovery sits under incident management as a dedicated response service. It’s not under any of our seven penetration testing services.
If you’ve been hacked, we’ll review source code and server logs to work out how the breach happened and make sure any backdoors are gone. A server hardening audit can help close the gaps that allowed the breach to happen in the first place.
If that's your situation, get in touch immediately.
Contact Us Today
Custom Scoping of Your Security Testing Service
We don't issue quotes off a rate card. Getting the price and timeline right takes a real understanding of your environment. Each of our projects starts with a scoping call.
That conversation covers your targets, the access you'll provide, and your timeline. We ask about the complexity of what we're testing, how many user roles are involved, and the scale of the systems in play.
The result is a project scope built around what you're protecting, not a generic package, and a cost estimate that reflects your systems rather than an average of everyone else's.
Ready to Scope Your Test?
We back every engagement with a 100% quality guarantee and free fix verification. If a test falls short of our standard, we keep working at no extra cost until it doesn't. Pick the service that matches your situation, and let's talk about what it should cover for you.
Book Your Free Scoping Call
Common Questions About Choosing Pentest Services
Do I Need a Web App Pentest or a Code Audit, or Both?
They test different things.
- A web app pentest looks at the running application from a user's (and attacker's) perspective: logins, sessions, data access.
- A code audit looks at the source itself for flaws that a black-box test can't reach, like a backdoor in the code that nobody's actively calling yet.
If your app handles sensitive data or was built in-house, both together give you the fuller picture.
Does Mobile App Testing Cover the Backend API, or Do I Need to Test That Separately?
Mobile testing on its own covers the app: local storage, permissions, and how it calls its backend. It doesn't fully test that backend as its own target. That's why mobile and web application testing are usually scoped together, so the API sitting behind the app gets the same scrutiny as the app itself.
How Do I Know If I Need More Than One Pentest Service at Once?
If your situation spans more than one layer, a mobile app with a backend, an app running in the cloud, or a custom-built system handling sensitive data, you likely need more than one.
The trigger table above is a starting point, not a final answer. A scoping call is where we confirm exactly what combination makes sense for your setup.
Let’s Get You Secure
Every business's setup is different, which is why we don't sell fixed packages. Tell us what you're building, what’s changed recently, or what's worrying you, and we'll help you work out which service, or combination, answers that.
Speak to a Tester
Want to Read More?
- Once you know which service fits your situation, learn exactly how the testing process unfolds in our guide on what to expect from a penetration test.
- Narrow down your vendor shortlist by learning the key questions to ask and red flags to avoid when choosing a penetration testing company.
- Ensure your internal team knows exactly how to react during a live breach by learning why you need to run an incident response drill.
