# Penetration testing services

Source: https://penetrationtestservices.com/services/
Publisher: Excession Labs (penetrationtestservices.com)
Last updated: 2026-11-09

Penetration testing services from Excession Labs for web apps, APIs and SaaS, plus pre-launch tests, tests after releases and customer security reviews.

Every service listed here uses the same method: a written scope, testing under agreed rules, evidence for every finding, and a retest of your fixes. Pick the page that matches your situation, or [tell us what you need](/contact/).

- [AI application security](https://penetrationtestservices.com/ai-application-security/): AI features such as chatbots, RAG and agents need a different security test from a web app. See why, and where Excession Labs scopes AI system assessments.
- [API penetration testing](https://penetrationtestservices.com/api-penetration-testing/): API penetration testing for REST and GraphQL APIs, mapped to the OWASP API Security Top 10 2023. Proven findings, a written report and fix guidance.
- [Penetration test report for a customer security review](https://penetrationtestservices.com/customer-security-review/): Prepare a penetration test report for an enterprise customer security review: what buyers ask for, report versus summary letter, what to share and timing.
- [Security testing for no-code and AI-built apps](https://penetrationtestservices.com/no-code-app-security-testing/): Security audit for Bubble, Supabase, Firebase and AI-built apps: privacy rules, RLS, Security Rules, exposed keys and workflow APIs, with a sample finding.
- [Pre-launch security testing for web apps and APIs](https://penetrationtestservices.com/pre-launch-security-testing/): Pre launch security testing for a web app or API: the seven areas to test first, how to set up staging, and what the pentest report should give your team.
- [Recurring penetration testing after each release](https://penetrationtestservices.com/recurring-penetration-testing/): Recurring vs continuous penetration testing: we test web apps and APIs after meaningful releases, scope only what changed, and verify fixes from the last report.
- [Penetration testing retest: checking that fixes work](https://penetrationtestservices.com/retesting/): A penetration testing retest checks that fixed findings are really fixed. See what we check, the four result statuses with a sample, and what you receive.
- [SaaS penetration testing for multi-tenant products](https://penetrationtestservices.com/saas-penetration-testing/): SaaS penetration testing for multi-tenant products: eight areas we test, the two-tenant method, a sample finding, and what the report contains.
- [SOC 2 penetration testing requirements and scope](https://penetrationtestservices.com/soc-2-penetration-testing/): SOC 2 penetration testing requirements: the criteria do not name a pentest, yet auditors and customers ask for one. See the TSC wording and the scope to agree.
- [Web application penetration testing: what we test and prove](https://penetrationtestservices.com/web-application-penetration-testing/): Web application penetration testing, black box or grey box: the eight areas we test, a sample finding with evidence, and the written report you receive.

## Not sure which one fits?

If a customer asked for a pentest report, start with [customer security reviews](/customer-security-review/). If you are about to launch, read [pre-launch testing](/pre-launch-security-testing/). If you ship every week and want each big change tested, see [recurring testing](/recurring-penetration-testing/).

If your product includes chat assistants, retrieval or agents that take actions, those parts need an [AI application security assessment](https://airedteamingservices.com/). The rest of the application is tested here.