.png){kind=small}
Web & API Security Testing
Deep testing of applications and APIs, including business logic.
Vulnerability Assessment & Penetration Testing
Find the gaps attackers would use, before they do.
ThreatGaurd combines automated discovery with expert manual testing across your networks, Active Directory, web and mobile applications, APIs and cloud, so you get proof of real risk and a clear plan for what to fix first.
Why it matters
Attackers need one weakness. Do you know where yours are?
New releases, cloud changes and third-party integrations open new gaps every month. Scanners list thousands of issues, but rarely show which ones can actually be exploited, or what they would mean for the business.
VAPT answers that question with evidence. We test your environment the way a real attacker would, confirm what is exploitable and show your teams exactly what to fix first.
-
Exposure you cannot see
Forgotten subdomains, open ports, test environments and old APIs widen your attack surface without anyone noticing.
-
Scanner noise, no proof
Automated tools report hundreds of issues, many of them false positives. Teams lose time while the real risks stay hidden.
-
Pressure from auditors and customers
ISO 27001, SOC 2, PCI DSS and enterprise customers increasingly ask for recent, independent test evidence.
Business outcomes
What VAPT gives your business
-
Fewer ways in
Find and close exploitable weaknesses before an attacker can use them.
-
Proof, not guesswork
Every finding is manually validated, with evidence and steps your team can reproduce.
-
A clear fix order
Issues are ranked by business impact, so effort goes where it removes the most risk.
-
Evidence that stands up
Reports are structured for auditors, customers and security questionnaires.
Testing scope
Test your whole attack surface, or just the part that matters now.
Choose one area or combine several. Every engagement is scoped to your environment, timelines and goals.
External network penetration testing
Everything reachable from the internet: websites, VPNs, mail servers, remote access and exposed services.
What we check
- Open ports and exposed services
- Outdated software and known vulnerabilities (CVEs)
- Weak TLS, VPN and remote-access configuration
- Forgotten subdomains and test systems
- VPN gateway Unpatched remote-access appliance Critical
- Remote desktop Exposed directly to the internet High
- Staging website Test system publicly reachable Medium
Internal network and Active Directory testing
What an attacker, or a compromised laptop, could reach once inside your network.
What we check
- Active Directory misconfigurations and attack paths
- Privilege escalation to domain admin
- Segmentation between sensitive network zones
- Weak, default and reused credentials
- Active Directory Path from a normal user to domain admin Critical
- File servers Sensitive shares readable by all staff High
- Payment network Not separated from office network High
Web application security testing
Customer portals, internal tools and SaaS platforms, tested well beyond the OWASP Top 10.
What we check
- Authentication, session and access-control flaws
- Injection, cross-site scripting and request forgery
- Business-logic abuse in pricing, approvals and workflows
- Data exposure between users and tenants
- Customer portal Users can open other users’ invoices Critical
- Checkout Price can be changed in the request High
- Admin login No limit on password attempts Medium
API security testing
REST, GraphQL and SOAP APIs behind your web and mobile apps, partner integrations and microservices.
What we check
- Broken object- and function-level authorization
- Authentication, tokens and API key handling
- Excessive data exposure and mass assignment
- Rate limiting and abuse controls
- Orders API Order records can be enumerated High
- Partner API Old API key still accepted after rotation High
- GraphQL Schema exposes internal fields Medium
Mobile application security testing
Android and iOS apps, tested together with the APIs they talk to, using OWASP MASVS.
What we check
- Insecure storage of data on the device
- Traffic interception and certificate pinning
- Hard-coded keys and secrets
- Tampering and reverse-engineering resistance
- Android app API secret hard-coded in the app High
- Both apps Traffic can be intercepted High
- iOS app Session token stored unencrypted Medium
Cloud security testing
AWS, Microsoft Azure and Google Cloud, tested from an attacker’s point of view.
What we check
- Exposed storage, databases and services
- Over-privileged identities and roles
- Paths from a single foothold to sensitive data
- Logging and detection gaps
- Storage bucket Customer files publicly readable Critical
- Developer role Can grant itself admin rights High
- Audit logging Not enabled in every region Medium
Methodology
Recognised methods, matched to your goals.
We follow established testing standards and agree the depth of testing with you during scoping.
-
Black box
No inside information, just like an external attacker.
Best for
Seeing what an outsider can reach.
-
Most common
Grey box
User-level access or test accounts, like a customer or employee would have.
Best for
Most applications and annual tests. The best balance of depth and time.
-
White box
Full access to architecture, documentation and, where useful, source code.
Best for
Critical systems and high-assurance requirements.
Standards we follow
- OWASP WSTG
- OWASP Top 10
- OWASP API Security Top 10
- OWASP MASVS
- NIST SP 800-115
- PTES
- CVSS scoring
How it works
From scoping call to verified fix, in five steps.
-
01
Scope and agree
We agree targets, testing windows, depth and rules of engagement. An NDA is signed before any access.
-
02
Discover
We map your attack surface and run automated discovery to find candidate weaknesses.
-
03
Exploit and validate
Our testers manually confirm what is truly exploitable and how far an attacker could get, without disrupting operations.
-
04
Report and walk through
You receive the reports, followed by a walkthrough with your leadership and technical teams.
-
05
Retest and close
Once your team has fixed the issues, we retest and update the report to show what is closed.
Deliverables
Reports written for the boardroom and the engineering team.
- Executive summary A short overview for leadership: overall risk, key issues and what to do next.
- Technical report Every finding with CVSS severity, evidence, affected assets and step-by-step fix guidance.
- Remediation plan Prioritised by business impact, with suggested owners and timelines.
- Retest report Confirms which issues are fixed, for your records and your auditors.
- Letter of attestation A summary you can share with customers and partners without exposing technical details.
Overall risk
High → Low after retest
- Critical
- 2
- High
- 6
- Medium
- 11
- Low
- 9
Open findings
28before retest,3after retest
Fix first
Customer data readable through the orders API
Owner: Platform team · 5 days
Use cases
When organisations run VAPT
-
Before a launch or major release
Find exploitable issues before customers, or attackers, reach the new system.
-
After infrastructure or cloud changes
Migrations, new environments and network changes often introduce misconfigurations.
-
Audit and certification evidence
Support evidence requirements for ISO 27001, SOC 2 and PCI DSS.
-
Customer and vendor security reviews
Answer security questionnaires with recent, independent test results.
-
After a security incident
Confirm the exploited weakness is closed and look for related gaps.
-
Mergers, acquisitions and investment
Understand the security posture of a business or platform before you commit.
Industries we work with
Why ThreatGaurd
Testing you can trust, from people who explain it clearly.
-
Expert-led, not scanner-led
Automated tools find candidates. Experienced testers decide what is real and how far it goes.
-
Built to avoid disruption
Agreed testing windows, controlled techniques and a named contact throughout the engagement.
-
Your data stays protected
NDA before access, encrypted report delivery and test data deleted after the engagement.
-
Retesting included
We confirm your fixes work, so the final report reflects your real position.
Supports compliance evidence for
- ISO/IEC 27001
- SOC 2
- PCI DSS
- HIPAA
- GDPR
- India DPDP Act
Our reports support your compliance evidence. Certification and audit opinions are issued by your auditor or certification body.
How we handle your dataGuides & checklists
Preparing for a penetration test?
Practical checklists and articles to help you scope the test, prepare your teams and get the most from the report.
Related services
Go further after the test.
-
-
Network & Firewall Security Assessment
Firewall rules, segmentation and perimeter exposure.
-
Security Configuration Hardening
Fix weak configurations against CIS Benchmarks.
-
Managed Vulnerability Management
Continuous scanning, triage and retesting between tests.
FAQ
Questions leaders ask about VAPT
Can’t find your answer? Our team is happy to help.
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment finds and lists known weaknesses, mostly with automated tools. A penetration test goes further: our testers try to exploit those weaknesses to prove what an attacker could really do. VAPT combines both, so you get broad coverage and proof of real risk.
Will testing disrupt our systems or users?
Testing is planned to avoid disruption. We agree testing windows and rules of engagement in advance, use controlled techniques, and stop and inform you immediately if anything unexpected happens. Higher-risk tests can be run against a staging environment.
How long does a VAPT engagement take?
Most engagements take 1 to 3 weeks from kick-off to report, depending on the number of applications, IP addresses and APIs in scope. Retesting is scheduled once your team has completed the fixes.
What do you need from us to get started?
A short scoping call, a list of targets (domains, IP ranges, applications or APIs), test accounts if the test is grey box, and a technical contact. We share a scope document and rules of engagement for sign-off before testing begins.
How is the cost calculated?
Cost depends on scope and depth: the number and size of applications, APIs and network ranges, the testing approach and whether retesting is included. After the scoping call you receive a fixed-scope proposal, so the cost is agreed before testing starts.
How often should we run a penetration test?
At least once a year and after any significant change, such as a major release, new infrastructure or a cloud migration. Many standards and enterprise customers expect this, and PCI DSS requires it.
Will your report satisfy our auditor or customer?
Our reports are structured to support ISO 27001, SOC 2, PCI DSS and customer security reviews, with an executive summary, detailed findings, retest results and a letter of attestation. The final audit opinion always rests with your auditor, so if a specific format or accreditation is required, tell us during scoping and we will confirm what we can provide.
How do you protect our data during testing?
We sign an NDA before any access, use only the access you approve, keep evidence to the minimum needed, deliver reports over an encrypted channel and delete test data at the end of the engagement.
Get started
Know where you stand, and what to fix first.
Tell us what you want to test. We will come back with a clear scope and proposal, with no obligation.
What happens next
- A short scoping callWe learn your goals, environment and timelines.
- A fixed-scope proposalClear scope, approach, timeline and cost, in writing.
- Testing on your scheduleTesting starts on the agreed date, with regular updates.