Application Defence Analysis
A look at how well your built app would stand up to attack, and where to strengthen it.
The problem
Once an app is built, the question is no longer "does it work?" but "how would it hold up against someone trying to break it?" A defence analysis looks at the app, how it is built and deployed, and the controls around it, then tells you where an attacker would get in and what to fix first.
What's included
- Review of the app design and the data it handles, to understand what an attacker would target
- Analysis of authentication, access control and session handling
- Review of how secrets, dependencies and third-party services are managed
- Review of the hosting, configuration and deployment pipeline around the app
- Review of logging and monitoring, so attacks would be noticed
- Prioritised recommendations to strengthen your defences
How it works
- 1
Scope and authorise
We agree what is in scope, the rules of engagement, and get written authorisation before any testing starts.
- 2
Review and test
We examine your configuration and, where agreed, test it the way an attacker would.
- 3
Report
You get a clear report: what we found, how serious it is, and how to fix it, in plain English.
- 4
Retest
Once you have made fixes, we check they actually worked.
FAQs
What kinds of apps can you look at?
The scope is agreed per engagement. Tell us what you have built and where it runs, and we will say honestly whether it is a good fit.
Is this the same as penetration testing?
They are related. A defence analysis focuses on reviewing how the app and its surroundings are built and protected. Penetration testing actively tries to break in. They work well together, and we can agree the right mix with you.
Do you need our source code?
Not always. Access depends on what is in scope, and we agree exactly what is needed, and keep it confidential, before starting.
Can you look at an app before it launches?
Yes. Reviewing before launch is usually the cheapest time to fix problems.