Tyk Security Review
Stack more than one Policy on a Tyk key and the most permissive rate limit wins. We test which Policies, authentication methods and plugins are actually stacked on your APIs. CREST-certified testers, fixed price from £3,350 for a 3-day single-estate scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Port 8080 is Tyk Gateway’s default listen port. Tyk’s own documentation says the Gateway API only moves onto a separate port once control_api_port is explicitly set.
Why Tyk security comes down to Gateway API exposure, how Policies merge and where plugins come from
Tyk Gateway listens on port 8080 by default for both live API traffic and its own management interface, and Tyk’s gateway configuration reference only separates the two once control_api_port is set. Every call to that management interface, the Tyk Gateway API, is checked against the secret value configured in tyk.conf and sent as an x-tyk-authorization header. We test which port the Gateway API actually answers on and how well that secret is protected.
Tyk allows more than one Policy to attach to a single Session, and Tyk’s own documentation on Policies says the merge takes the most permissive rate limit and unions the access rights of every attached Policy. We test which Policies are stacked on each Session and whether the combined result still matches what you intended to grant.
Custom plugins reach Tyk Gateway as a downloaded remote bundle, a gRPC call to a remote server, inline JavaScript, or a file mounted or baked into the Gateway image, and Tyk does not version local plugins for you. For the wider API gateway family this review sits alongside, see our Kong Gateway security review.
SCOPE
What we review on a Tyk gateway
Gateway API Exposure: Control Port and the Secret Header
Tyk Gateway’s own management API answers on the same port as live traffic, port 8080, unless control_api_port is set to move it onto a separate port. We test which port the Gateway API actually answers on and whether the tyk.conf secret behind it is guessable or exposed.
Session and Policy Merge Logic
Tyk lets more than one Policy attach to a single Session, and the merge takes the most permissive rate limit and combines the access rights of every attached Policy. We test which Policies are stacked on each Session and what that combination actually grants.
Client Authentication Method Choice
Tyk supports Auth Tokens, Basic Authentication, HMAC Signatures, Certificate Authentication, JWT and OAuth2 or OpenID Connect as separate authentication methods, each with its own lookup key. We test whichever method your APIs are configured to accept against what it actually verifies.
Certificate Authentication and Private Key Storage
Certificate Authentication, added in Tyk 5.12.0, authenticates a client from its mTLS certificate alone, and uploaded certificate private keys are AES256-encoded using a secret you configure. We test whether that encoding secret and the wider Certificate Store are handled as carefully as the certificates themselves.
Custom Plugin Source and Delivery
A custom plugin can reach Tyk Gateway as a downloaded remote bundle, a gRPC call to a remote server, inline JavaScript, or a file mounted or baked into the Gateway image, and Tyk does not version local plugins for you. We test how each configured plugin is delivered and whether its source is verifiable.
Rate Limiter Choice and Spike Arrest Behaviour
Tyk’s Redis Rate Limiter keeps a shared, cluster-wide sliding window log in Redis and, once the configured limit is exceeded, blocks every further call until the rate stays below that limit for a full window. We test which rate limiter is enabled and confirm it matches the availability the API needs.
Dashboard RBAC, API Ownership and User Groups
Tyk Dashboard’s user management covers role-based permissions, user groups and teams, and API Ownership, which applies role-based access control to individual APIs so only specific teams can view or manage them. We test what each role, group and API Ownership assignment can actually reach.
Secrets in API Definitions and Vault Integration
A Tyk API definition can reference an external value with a secrets:// prefix instead of storing it in plain text, and Tyk Gateway also supports HashiCorp Vault as a key-value backend. We check every API definition and Operator manifest in source control for a credential that should be a secrets:// reference instead.
Analytics, Tyk Pump and Raw Traffic Retention
Tyk Pump moves every request’s traffic log out of Redis, and its omit_detailed_recording setting is what excludes the raw_request and raw_response fields from what gets stored. We test whether detailed recording is switched on for APIs that carry personal or sensitive data.
Deployment Model: Cloud, Self-Managed and Operator
A Tyk Cloud deployment splits into a hosted Control Plane and a Cloud Data Plane, self-managed Tyk Gateway runs entirely on your own infrastructure, and Tyk Operator manages APIs as Kubernetes ApiDefinition custom resources. We confirm during scoping which model is in force, since it changes where the Gateway API and its secret actually sit.
OUR PROCESS
Tyk Security Review: From Scope to Attestation
Scope and Access
We agree which APIs, Policies, Sessions and environments are in scope, plus a Dashboard account for each RBAC role and a key for each authentication method to be tested.
Policy and Plugin Mapping
We map every Policy attached to each Session against Tyk’s merge rules, and catalogue every custom plugin and how it is delivered.
Manual Testing
A CREST-certified tester manually tests Gateway API exposure, policy-merge outcomes, authentication methods, certificate handling and plugin and secrets configuration.
Attestation and Retest
You get a technical report with CVSS scores, a walkthrough call, a free retest, and an attestation letter.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Tyk pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Tyk Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
3 to 4 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote4 to 6 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote6 to 8 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Tyk For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Tyk Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Tyk gateway?
We need a Tyk Dashboard account for each RBAC role in scope, a working key or credential for every authentication method configured, and confirmation of whether the Gateway API sits on a separate control_api_port.
Does testing touch our live API traffic or data?
We test the gateway’s access-control layer, Policy and Session configuration, plugins and Gateway API rather than sending arbitrary traffic through production; the exact scope and any data-sensitive APIs are agreed with you before testing starts.
How long does a Tyk security review take?
A single estate sits in our 3-day single-estate scope, with a report typically landing around 5 working days after kickoff.
Do you test Tyk Cloud the same way as self-managed Tyk Gateway?
The Session and Policy model is the same everywhere, but where the Gateway API and control port sit differs between a Cloud Data Plane and a self-managed Gateway, so we confirm the deployment model during scoping.
What’s out of scope?
We don’t test Tyk’s own hosted Cloud Control Plane infrastructure or the open-source Gateway codebase itself; we test your API definitions, Policies, keys, plugins and configuration.
Does Tyk have a policy on customer penetration testing?
Self-managed Tyk Gateway is software you run yourself, so there is no vendor notification process; Tyk Cloud is Tyk’s hosted platform, so we confirm current terms during scoping.
Do you review our custom plugins?
Yes, we review how each configured plugin, whether a remote bundle, a gRPC service, inline JavaScript or a local file, is delivered, verified and loaded, and what it does with request data.
What if we run Tyk Operator on Kubernetes?
We review your ApiDefinition custom resources and how plugin files and secrets are mounted into the cluster, alongside the Gateway configuration itself.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Tyk gateway security review
Stack more than one Policy on a Tyk key and the most permissive rate limit wins. We test which Policies, authentication methods and plugins are actually stacked on your APIs. CREST-certified testers, fixed price from £3,350 for a 3-day single-estate scope, quoted within 24 hours.
