# Penetration Test Services > Authorized penetration testing of web applications, APIs and SaaS platforms. Evidence for every finding, fix guidance and a retest. Penetration Test Services is operated by Excession Labs (https://excessionlabs.ai). Contact: support@excessionlabs.ai. Excession Labs tests only systems whose owner has given written authorization. Every page is also available as Markdown: add `index.md` to the page URL. ## Key pages - [About Excession Labs](https://penetrationtestservices.com/about/index.md): Excession Labs builds Incursion, an AI agent for authorized security testing, and runs penetration tests of web applications, APIs and SaaS platforms. - [Request a penetration test](https://penetrationtestservices.com/contact/index.md): Request a penetration test quote: tell us what to test, why and by when. We reply by email to book a short scoping call. Testing starts after written authorization. - [Free penetration test pilot](https://penetrationtestservices.com/free-pentest/index.md): Apply for a free pentest pilot from Excession Labs: a small written scope, real testing under written authorization, and every finding with evidence and a fix. - [Penetration testing guides](https://penetrationtestservices.com/guides/index.md): Practical guides on planning a pentest, web and API testing, SaaS isolation, compliance evidence and reading a pentest report, from Excession Labs. - [Penetration testing services for web apps, APIs and SaaS](https://penetrationtestservices.com/index.md): Authorized penetration testing of web applications, APIs and multi-tenant SaaS by Excession Labs. Evidence for every finding, fixes and a retest. - [How we test: our penetration testing methodology](https://penetrationtestservices.com/methodology/index.md): Pentest methodology of Excession Labs: written authorization, evidence standard, controls, safety limits, evidence labels, severity scale and report contents. - [Penetration testing pricing: what changes the quote](https://penetrationtestservices.com/pricing/index.md): Penetration testing cost at Excession Labs: ten scope factors that change the quote, what every quote includes, and how to request a written proposal. - [Privacy notice](https://penetrationtestservices.com/privacy/index.md): What Penetration Test Services collects when you visit or send a request, why, where it is stored, how long we keep it and how to contact Excession Labs about your data. - [Sample penetration testing report for a fictional app](https://penetrationtestservices.com/sample-report/index.md): A full sample penetration testing report for a fictional SaaS app: scope, method, nine findings with requests and evidence, controls that held, and a fix plan. - [Penetration testing services](https://penetrationtestservices.com/services/index.md): Penetration testing services from Excession Labs for web apps, APIs and SaaS, plus pre-launch tests, tests after releases and customer security reviews. ## Services - [AI application security](https://penetrationtestservices.com/ai-application-security/index.md): AI features such as chatbots, RAG and agents need a different security test from a web app. See why, and where Excession Labs scopes AI system assessments. - [API penetration testing](https://penetrationtestservices.com/api-penetration-testing/index.md): API penetration testing for REST and GraphQL APIs, mapped to the OWASP API Security Top 10 2023. Proven findings, a written report and fix guidance. - [Penetration test report for a customer security review](https://penetrationtestservices.com/customer-security-review/index.md): Prepare a penetration test report for an enterprise customer security review: what buyers ask for, report versus summary letter, what to share and timing. - [Security testing for no-code and AI-built apps](https://penetrationtestservices.com/no-code-app-security-testing/index.md): Security audit for Bubble, Supabase, Firebase and AI-built apps: privacy rules, RLS, Security Rules, exposed keys and workflow APIs, with a sample finding. - [Pre-launch security testing for web apps and APIs](https://penetrationtestservices.com/pre-launch-security-testing/index.md): Pre launch security testing for a web app or API: the seven areas to test first, how to set up staging, and what the pentest report should give your team. - [Recurring penetration testing after each release](https://penetrationtestservices.com/recurring-penetration-testing/index.md): Recurring vs continuous penetration testing: we test web apps and APIs after meaningful releases, scope only what changed, and verify fixes from the last report. - [Penetration testing retest: checking that fixes work](https://penetrationtestservices.com/retesting/index.md): A penetration testing retest checks that fixed findings are really fixed. See what we check, the four result statuses with a sample, and what you receive. - [SaaS penetration testing for multi-tenant products](https://penetrationtestservices.com/saas-penetration-testing/index.md): SaaS penetration testing for multi-tenant products: eight areas we test, the two-tenant method, a sample finding, and what the report contains. - [SOC 2 penetration testing requirements and scope](https://penetrationtestservices.com/soc-2-penetration-testing/index.md): SOC 2 penetration testing requirements: the criteria do not name a pentest, yet auditors and customers ask for one. See the TSC wording and the scope to agree. - [Web application penetration testing: what we test and prove](https://penetrationtestservices.com/web-application-penetration-testing/index.md): Web application penetration testing, black box or grey box: the eight areas we test, a sample finding with evidence, and the written report you receive. ## Guides - [After the pentest: remediation, retest and close-out](https://penetrationtestservices.com/guides/after-the-pentest-remediation-and-retest/index.md): What to do after a penetration test: triage findings, assign fixes, verify them, request a retest and close out with evidence. Includes a tracker template. - [Authentication testing checklist: login, reset, MFA, sessions and OAuth](https://penetrationtestservices.com/guides/authentication-testing-checklist/index.md): An authentication testing checklist for web apps and APIs: login, password reset, MFA, sessions, OAuth and account enumeration, with proof and fixes. - [Black box vs grey box vs white box penetration testing](https://penetrationtestservices.com/guides/black-box-grey-box-white-box-testing/index.md): How black box, grey box and white box penetration tests differ, what each costs you in time and depth, and a decision table to choose one. - [Bubble app security: privacy rules, Data API and workflow API checklist](https://penetrationtestservices.com/guides/bubble-app-security/index.md): How to check your own Bubble app: privacy rules on every data type, Data API and Workflow API settings, search exposure and client-side data, with a test checklist. - [Business logic vulnerabilities: examples, testing and fixes](https://penetrationtestservices.com/guides/business-logic-vulnerabilities/index.md): What business logic vulnerabilities are, why scanners miss them, examples in pricing, workflows and limits, how testers prove them and how to fix them. - [CSRF testing: how pentesters check tokens, SameSite and login CSRF](https://penetrationtestservices.com/guides/csrf-testing/index.md): How to test CSRF protection: an 8-step method, a test-case table for tokens, Origin and SameSite, JSON endpoints, login CSRF, and proof in a real browser. - [Does SOC 2 require penetration testing?](https://penetrationtestservices.com/guides/does-soc-2-require-penetration-testing/index.md): Does SOC 2 require penetration testing? No. See the AICPA CC4.1 wording, why auditors still ask for a pentest report, and five questions to settle first. - [Firebase security rules testing: Firestore, Storage and the emulator](https://penetrationtestservices.com/guides/firebase-security-rules-testing/index.md): Firebase security rules testing for Firestore, Storage and Realtime Database: working unit tests for the Local Emulator Suite, safe example rules, and a checklist. - [HIPAA penetration testing: what the Security Rule says today and what HHS proposed](https://penetrationtestservices.com/guides/hipaa-penetration-testing/index.md): HIPAA penetration testing requirements as of November 2026: the Security Rule in force does not name a pentest, and the January 2025 HHS proposal is not final. - [How often should you pentest? Standards, triggers and a schedule](https://penetrationtestservices.com/guides/how-often-should-you-pentest/index.md): How often should you pentest? The PCI DSS 11.4 wording, SOC 2 and ISO 27001 position, ten changes that should trigger a test, and a schedule table by profile. - [How to prepare for a penetration test: a checklist](https://penetrationtestservices.com/guides/how-to-prepare-for-a-penetration-test/index.md): How to prepare for a penetration test: write the scope, create test accounts, load test data, pick an environment, name contacts and set a freeze window. - [How to read a penetration testing report, section by section](https://penetrationtestservices.com/guides/how-to-read-a-penetration-testing-report/index.md): How to read a penetration testing report section by section: the 13 parts, an annotated sample finding, severity versus priority, and how to plan fixes. - [IDOR testing: how pentesters find broken object-level authorization](https://penetrationtestservices.com/guides/idor-testing/index.md): IDOR testing step by step: prove it with two accounts and a read-back, use a 7-case test table and demo requests, and fix BOLA with a server-side check. - [ISO 27001 penetration testing: what the standard asks and auditors check](https://penetrationtestservices.com/guides/iso-27001-penetration-testing/index.md): ISO 27001 penetration testing requirements: the standard does not name a pentest. See Annex A 8.8, 8.29 and 8.34, an evidence pack, and what to ask your auditor. - [Multi-tenant isolation testing: how to check that tenants cannot see each other](https://penetrationtestservices.com/guides/multi-tenant-isolation-testing/index.md): Multi-tenant security testing for SaaS: a two-tenant matrix of 12 areas (IDs, search, exports, caches, files), a sample leaking request and row-level security fixes. - [OWASP API Security Top 10 (2023): the list and how to test each risk](https://penetrationtestservices.com/guides/owasp-api-security-top-10/index.md): The OWASP API Security Top 10 2023 list with exact IDs from API1 to API10, plus test ideas, sample requests, a test-case table and the usual fix for each risk. - [OWASP Top 10 2025: the list and what pentesters check for each item](https://penetrationtestservices.com/guides/owasp-top-10-2025/index.md): OWASP Top 10:2025 with exact IDs, a one-line meaning for each category, a 2021 to 2025 mapping table and the checks a penetration tester runs. - [PCI DSS penetration testing requirements: Requirement 11.4 explained](https://penetrationtestservices.com/guides/pci-dss-penetration-testing-requirements/index.md): PCI DSS penetration testing requirements 11.4.1 to 11.4.7 (v4.0.1) in one table: test frequency, who may test, segmentation, and questions for your QSA. - [Penetration testing rules of engagement: what to agree in writing](https://penetrationtestservices.com/guides/penetration-testing-rules-of-engagement/index.md): Pentest rules of engagement: what to agree in writing (authorization, scope, test windows, off-limits actions, stop conditions, data) plus a template outline. - [Pentest attestation letter: what it contains and what it cannot prove](https://penetrationtestservices.com/guides/pentest-attestation-letter/index.md): Pentest attestation letter: what it contains, a letter outline you can adapt, how it differs from a full report, and what no letter can prove to a buyer. - [Rate limiting and credential stuffing: how to test safely](https://penetrationtestservices.com/guides/rate-limiting-and-credential-stuffing/index.md): Credential stuffing testing and rate limit tests done safely: OWASP OAT-008, a bounded test design, test cases for login, reset and MFA, and how to fix gaps. - [Red team vs penetration testing: what is the difference?](https://penetrationtestservices.com/guides/red-team-vs-penetration-testing/index.md): Red team vs pentest: how the two differ in goal, scope, stealth and who knows, with an 11-row comparison table and a decision table for choosing one. - [Security questionnaire pentest questions: what buyers ask and how to answer](https://penetrationtestservices.com/guides/security-questionnaire-pentest-questions/index.md): Pentest questions in security questionnaires (SIG, CAIQ, custom): 14 common questions with honest answer patterns, the evidence to attach, and what to avoid. - [Supabase security audit: RLS, API keys, storage and RPC checklist](https://penetrationtestservices.com/guides/supabase-security-testing/index.md): Supabase security audit for your own project: an 8-step checklist for RLS, publishable and secret keys, views, storage and RPC, with example policies. - [What is penetration testing? A plain guide for software teams](https://penetrationtestservices.com/guides/what-is-penetration-testing/index.md): What is penetration testing? What a pentest produces, the main types, how it differs from a vulnerability scan, five phases and one worked example finding. ## Related Excession Labs sites - [aipentestservices.com](https://aipentestservices.com/llms.txt): AI-assisted penetration testing with human review - [airedteamingservices.com](https://airedteamingservices.com/llms.txt): Security assessments of LLM apps, RAG and AI agents - [pentestcompare.com](https://pentestcompare.com/llms.txt): Sourced comparison of pentest providers ## Optional - [Full text of this site](https://penetrationtestservices.com/llms-full.txt)