External attack surface
Review the agreed domains, applications, APIs, and exposed services for possible entry points.
Penetration testing and offensive security
Test whether weaknesses in the systems you authorise can lead to unintended access or data exposure. ACW investigates the agreed attack surface and documents findings with evidence, impact, and recommended remediation.
Contact UsTest a defined exposure question
A list of potential vulnerabilities does not explain which ones affect your product. A scoped assessment examines how selected weaknesses behave in the target environment and whether they combine into a meaningful attack path.
The report should distinguish confirmed findings, unverified concerns, and areas that were not tested. Testing provides evidence from that engagement; it cannot establish the absence of every vulnerability.
Focus testing on the authorised systems
What your team receives
A record of targets, methods, exclusions, and test conditions.
Validated findings with reproducible evidence and affected assets.
Observed attack paths and their practical limitations.
Prioritised remediation recommendations.
Retest findings where a retest is included.
Agree the rules before testing
- Step 01.
Scope and authorise
Confirm asset ownership or testing permission, environments, accounts, test window, permitted methods, and exclusions.
- Step 02.
Set operational limits
Define contacts, stop conditions, handling of sensitive evidence, and restrictions on disruptive testing.
- Step 03.
Test and validate
Combine suitable technical tests with manual review. Escalate urgent findings through the agreed channel.
- Step 04.
Report and follow up
Explain evidence, impact, and remediation to the team responsible for fixes. Verify selected corrections in the agreed version or environment.
Connect findings to remediation
Each finding should identify affected components, prerequisites, supporting evidence, and a proposed correction. Severity should reflect observed exposure and business context. A retest records whether the reported issue can still be reproduced; it does not certify future security.
This is an example of a possible engagement, not an ACW client result.
Illustrative assessment: account permissions
Approved test accounts represent different roles. The assessment checks whether each can access only its permitted functions and records. Any demonstrated boundary failure is documented with limited evidence and a remediation recommendation, then retested if included.
Questions before testing
Is this an automated vulnerability scan?
Scanners can contribute findings. The engagement must specify manual validation, test coverage, and the evidence used to confirm practical impact.
Can testing happen in production?
The environment, timing, permitted methods, and operational risks must be agreed first. A production target is not assumed.
Are fixes and retesting included?
Define them separately. The test report supports remediation, while implementation and later verification need assigned owners and scope.
Define what you need tested
Tell us the system, the security concern, and the environments and permissions available for an assessment.