Penetration Testing for the Application You Built
Tell us what you built and we will show you how we test it. Multi-tenant SaaS, customer portals, marketplaces, checkouts, mobile apps and AI assistants each have their own users, roles and ways to go wrong. CREST-certified UK testers, a fixed price and 24-hour scoping whatever you run.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
ways to describe the same engagement: who you are, what you built, how you built it, and what you are worried about. This page starts from what you built.
Your Application Decides What We Test
Buyers describe the system, not the test. Most enquiries start with a sentence like “we run a broker portal on Salesforce” or “we have a multi-tenant SaaS on Supabase”. The users, roles and data in that sentence decide where the serious findings hide, so we scope from the application first.
Different applications, different failures. A multi-tenant platform fails when one customer reaches another’s data. A marketplace fails when a seller changes a payout. A checkout fails when a price or payment state can be tampered with. Each page below explains the trust boundaries we test for that kind of system.
Connected to your sector and stack. Every application page links to the sector pages and technology pages that go with it, so you can read about your industry, your system and your stack in one place.
BY APPLICATION
Applications We Pen Test
Multi-Tenant SaaS
Tenant isolation, row-level security, delegated admins, invites, SSO provisioning, exports and background jobs.
Customer Portals & Admin Dashboards
Organisation invites, document ownership, delegated administrators, support impersonation and data exports.
Online Marketplaces
Buyer, seller and staff boundaries, seller onboarding, payouts, listings, reviews and disputes.
Checkout & Payment Flows
Price and currency integrity, payment state, callbacks and webhooks, refunds and the scripts on your payment page.
Mobile Apps & Their Backends
iOS, Android, React Native and Flutter apps, device storage, deep links and the API authorisation behind them.
Public & Partner APIs
Object-level authorisation, API keys and OAuth scopes, webhooks, rate limits and undocumented endpoints.
Identity & Single Sign-On
SAML and OIDC login, account linking, provisioning and account recovery.
AI Assistants & Agents
Prompt injection, retrieval of data the user should not see, and tools an agent should not be able to call.
OUR PROCESS
From Scope to Attestation in 4-6 Weeks
Scoping Call
30-minute technical scoping call. We map your roles, objects and integrations, agree rules of engagement and timeline. Fixed-price quote within 24 hours.
Active Testing
3-15 days of hands-on testing by CREST-certified pen testers. Daily status updates and live findings delivered to your client portal.
Reporting
Executive summary plus full technical report with CVSS scores, reproduction steps, screenshots, and specific remediation. 60-minute walkthrough call.
Free Retest
After remediation, we retest at no extra charge. Letter of attestation provided for audit, customer due diligence or procurement.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST application pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Aligned to Every Framework
Findings map to specific control references in each framework, so your audit team submits the report directly without translation work.
OWASP ASVS
Findings mapped to the Application Security Verification Standard.
OWASP API Top 10
API findings mapped to their API Security Top 10 category.
SOC 2
Evidence for the evaluations your auditor reviews under CC4.1.
ISO 27001
Annex A 8.8 technical vulnerability management, once you declare that control applicable.
PCI DSS
Requirement 11.4 penetration testing where card data is in scope.
UK GDPR
Article 32(1)(d) evidence that you regularly test the effectiveness of your security measures.
PRICING
Transparent Application Penetration Testing Pricing
Pricing depends on the number of roles, objects and integrations in scope, and on business-logic depth. The day count flexes; the included deliverables stay the same across all engagements.
Depends on app complexity
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quoteDepends on app complexity
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quoteDepends on app complexity
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteWHY EJN LABS
What You Get From Application Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What if my application is not listed?
The list is what comes up most often, not a limit. Describe your system in the quote form: who uses it, what they can do and what it connects to. We scope from that and tell you honestly whether we have tested something similar.
Should I read the sector, application or technology page?
Whichever describes you best. Sector pages cover the regulators and buyers you answer to, application pages cover the users and data inside your system, and technology pages cover the stack it is built on. Each links to the others.
How do you scope an application test?
We list the roles, the objects each role can touch, and the integrations. Price and duration follow the number of role and object combinations that need testing, not the number of pages.
Do you test in production?
We prefer a staging environment that mirrors production, with test accounts for every role. Production testing is possible with agreed limits on destructive actions and real transactions.
What’s in the report?
Executive summary (board-ready), technical report with CVSS 3.1 scores, reproduction steps, screenshots, specific remediation guidance, and a 60-minute walkthrough call. Letter of attestation issued after free retest.
Do you sign NDAs?
Yes. We sign client-supplied NDAs as standard. Engagement data is protected under our ISO 27001 (BSI-audited) information security management system.
How quickly can you start?
From signed scope to active testing in 24 hours where required. Standard pipeline is 3-5 business days from initial scoping call to test start.
Are your testers UK-based and what certifications do they hold?
Every engagement is performed by vetted UK-based CREST-certified testers matched to your engagement based on security clearance, compliance scope, and sector specialism. Testers hold CREST certifications relevant to their discipline (CRT, CCT APP, CCT INF, CCSAM).
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get my application pen test scope
Tell us what you built. A CREST-certified pen tester will contact you within one business day with a fixed price.
