Skip to content
Test management and QAStrategy, planning and control through to sign-off.Test automationRegression tests that run with every build.Load and performance testingPeak load, month-end, campaigns.Security and penetration testingScans in the pipeline, pen tests to OWASP.AI in testingFaster testing, sign-off stays with people.IT experts on demandISTQB-certified, quickly on board.
All services follow the ISTQB standard.All services
Banks and financial servicesCore banking, payments, DORA.InsurancePolicies, claims, rating engines.Rail and logisticsSystems that run around the clock.More industriesTelecoms, automotive, public sector, industry.
Server units with status lights in a rack

Security and penetration testing

Security gaps rarely show up in functional testing. We check your applications and APIs specifically for vulnerabilities and make security testing a fixed part of every release.

When this fits

  • An application with customer data or payment functions goes live.
  • DORA, PCI DSS or internal policies require regular security testing.
  • Security reviews happen once a year, but releases happen every week.
  • After an incident, you want to check whether there are further gaps.

What we test

Web applications
Testing against OWASP Top 10 and OWASP ASVS, login, sessions, permissions.
APIs
REST, SOAP and GraphQL against the OWASP API Security Top 10.
Mobile apps
Data storage, communication and protection mechanisms of Android and iOS apps.
Code and dependencies
Static analysis and checks of libraries and containers for known vulnerabilities.
Infrastructure
Vulnerability scans of servers and network services within the agreed scope.

How we work

  1. Define the scope

    We agree scope, time windows and rules in writing before any test starts.

  2. Automated checks

    Scans of application, code and dependencies, permanently in the pipeline if you wish.

  3. Manual penetration test

    We look specifically for gaps that no scanner finds, for example in the business logic.

  4. Report and retest

    Every vulnerability with risk, proof and recommendation. After the fix, we test again.

What you get

Report
Vulnerabilities with risk rating, proof and recommendation
Summary
Clear for management, internal audit and supervisors
Retest
Confirmation that the gaps are closed
Pipeline
Automated security checks with every release

Tools

OWASP ZAP, Burp Suite, Nessus, OpenVAS and Nmap for dynamic tests and scans. SonarQube, Semgrep and Checkmarx for static analysis. Snyk, OWASP Dependency-Check and Trivy for dependencies and containers.

Project example

Fintech platform

Client
Fintech
Starting point
Mobile app and platform were to be delivered more securely and faster
Task
Security testing with OWASP ZAP and Burp Suite, automated mobile tests with Appium in GitLab CI
Result
Critical vulnerabilities fixed before go-live, 25 % shorter delivery times

25 %

shorter delivery times

Signed off
All projects

Let’s talk

Tell us briefly what it’s about. We reply within one business day.

Go to contact formservices@cubio-consulting.com