Vulnerability assessment vs penetration testing
Compare a scan, an assessment, a manual pentest, and a re-test. Get the questions that make VAPT proposals easier to compare.
The practical bits
Penetration testing guides
Plan the scope, compare proposals, and understand the evidence before booking a penetration test. These guides cover application testing, SOC 2, AI security, reporting, and ongoing testing.
Choose the guide for your assessment
Start with the decision you need to make: which assessment to buy, what evidence a reviewer needs, how to scope an AI feature, or when to test a changing product.
Does SOC 2 require a penetration test?
Define the audit boundary, confirm evidence with your reviewer, and leave time for remediation and re-testing.
How to plan LLM application security testing
Map data sources, tool permissions, and human approvals before a scoped assessment.
PTaaS vs an annual penetration test
Compare scope, cadence, reporting, and re-test terms for a changing product.
Scope, cost and evidence
Prepare your penetration testing brief
Define access, compare the work behind a quote, and check what belongs in the report.
AI in pentesting: useful help, work to check
Where a model can help, where it can mislead, and what to ask before your data goes anywhere near one.
Read about AI in testingHow to scope a web & API pentest
Turn "test our app" into a brief that names the work and makes quotes easier to compare.
Read the guideWhat a good pentest report should include
Look past the severity chart. Could an engineer follow one finding without the tester in the room?
Read the guideThe SaaS pentest readiness checklist
Working accounts, useful test data, and someone who can answer the phone when access breaks.
Use the checklistWhat goes into a web & API pentest quote?
Compare the actual work behind each price, including setup, reporting, and the re-test.
Read the pricing guideAbout the writing
Practical guidance with clear sources and limits
You might be booking your first pentest or preparing your fifth. These guides focus on the details that make the job easier: clear scope, working access, and a report your team can use.
Examples are illustrative. External research is linked and kept separate from claims about our work. No guide or time-limited test can promise a permanently secure product. Read our publication and evidence standards.
Still have a question?
Tell us what you're planning.
We can help you work out the scope for a web application, API, or SaaS pentest. Teams in India can start with the remote VAPT brief. A rough description and a target date are enough to start.