Penetration Test Servicesby Excession Labs Request a test

Penetration testing services

Penetration testing services from Excession Labs for web apps, APIs and SaaS, plus pre-launch tests, tests after releases and customer security reviews.

Every service listed here uses the same method: a written scope, testing under agreed rules, evidence for every finding, and a retest of your fixes. Pick the page that matches your situation, or tell us what you need.

Web app testingWeb application penetration testing: what we test and proveAuthorized black-box and grey-box testing of your web application, with proven findings and a written report.API testingAPI penetration testingREST and GraphQL API testing against the OWASP API Top 10 2023, with evidence for each finding.SaaS testingSaaS penetration testing for multi-tenant productsMulti-tenant SaaS testing: tenant isolation, roles, invitations, billing and admin paths.Customer reviewsPenetration test report for a customer security reviewA pentest report you can use in enterprise security reviews, with a clear scope and evidence.Before launchPre-launch security testing for web apps and APIsTest your app before real users and real data arrive.After releasesRecurring penetration testing after each releaseRepeat testing after meaningful releases, scoped to what changed.Fix verificationPenetration testing retest: checking that fixes workCheck that fixed findings are really fixed, with evidence.SOC 2 supportSOC 2 penetration testing requirements and scopeA scoped pentest and report for SOC 2 evidence, with no acceptance promises.No-code appsSecurity testing for no-code and AI-built appsTesting for Bubble, Supabase and Firebase apps and apps built with AI coding tools.AI featuresAI application securityWhy AI features need a different test, and where to scope it.

Not sure which one fits?#

If a customer asked for a pentest report, start with customer security reviews. If you are about to launch, read pre-launch testing. If you ship every week and want each big change tested, see recurring testing.

If your product includes chat assistants, retrieval or agents that take actions, those parts need an AI application security assessment. The rest of the application is tested here.

Need a pentest you can act on?

Tell us what you need tested and why. We reply to agree scope, and testing starts only after written authorization.

Request a testSee the sample report