Services
Security assessments for every system your business relies on.
Choose the assessment that matches what you want to protect. Not sure which? We will help you decide.
Every business runs a different mix of websites, apps, APIs, cloud accounts and networks. Each needs a different kind of check. Here is what each service covers, in plain language.
01Services
Category A: Application security
| Service | In plain English | Consider it if you… | Status |
|---|---|---|---|
| Web Application Security Testing | We test your website or web app the way an attacker might, to find weaknesses that could expose information or allow misuse. | run a customer portal, online store or SaaS product | Core |
| API Security Testing | We check the connections (APIs) that let your apps, partners and systems exchange data. | have mobile apps, integrations or partners | Core |
| Mobile Application Security Testing | We assess your Android and iOS apps and how they talk to your servers. | publish a mobile app | Core |
| Source Code Security Review | We read your application code to find weaknesses before release. This differs from testing a running application. | want to catch problems early in development | Optional |
| Configuration and Deployment Review | We review hosting, permissions and deployment settings that can create risk. | have recently changed how you host or deploy | Optional |
02Services
Category B: Cloud and infrastructure
| Service | In plain English | Consider it if you… | Status |
|---|---|---|---|
| Cloud Security Assessment | We review your AWS, Azure or Google Cloud setup for settings that could expose data or systems. | run workloads in the cloud | Core |
| Network Security Assessment | We look for weaknesses in internal and external networks and exposed services. | operate offices, servers or hybrid networks | Core |
| Infrastructure and Server Security Testing | We test servers and supporting systems for outdated software and risky configuration. | host your own systems | Core |
| External Attack Surface Assessment | We find what the internet can see of your business, such as public services and subdomains, so you know what to investigate. | are unsure what you have online | Core |
| Container and Kubernetes Security | We review container images, deployment settings and permissions. | deploy with containers | Optional |
03Services
Category C: AI and emerging technology
| Service | In plain English | Consider it if you… | Status |
|---|---|---|---|
| AI Application Security Testing | We check AI-powered apps for weaknesses that affect data, behaviour or connected systems. | ship AI features | Core |
| LLM Security Testing | We test how language-model features respond to manipulated instructions and handle data. | use chatbots or assistants | Core |
| AI Agent and Integration Security | We assess what an AI agent can access and which actions it can take. | connect AI to tools, data or workflows | Core |
04Services
Category D: Testing and validation
| Service | In plain English | Consider it if you… | Status |
|---|---|---|---|
| Penetration Testing | A controlled, authorised attempt to exploit weaknesses, showing what is possible in practice. | need proof of real-world impact | Core |
| Vulnerability Assessment | A broad search for known and likely weaknesses across the systems in scope. | want a wide first view | Core |
| Retesting and Validation | We check again whether reported issues are fixed. Availability depends on your agreement. | have fixed reported issues | Core (agreement-dependent) |
| Security Configuration Review | We review security settings that are easy to overlook. | want a focused settings check | Optional |
| Security Posture Assessment | A broader view of your current security position and improvement priorities. | want a roadmap | Optional |
05Services
Category E: Specialised assessments
- Internal and external penetration testing
- Core, inside the Penetration Testing page
- Digital asset discovery
- Core, inside External Attack Surface
- Network segmentation assessment
- Optional, inside Network Security
- Database security assessment
- Optional, inside Infrastructure Security
- Identity and access security review
- Optional, specialised list
- Wireless network security assessment
- Optional, specialised list
- Active Directory security assessment
- Optional, for enterprises
- IoT device security testing
- Roadmap
- Secure configuration reviews
- Merged into Security Configuration Review
- Business-specific assessments
- Custom scope on request
- Remediation consultation
- Optional
- Security programme improvement consulting
- Roadmap
06Ongoing
Security is a cycle, not a one-time event.
Where supported, Vulnetra can help you manage security over time: periodic assessments, tracking of findings, prioritisation of risk, follow-up checks, assessment history and consolidated reporting, with your team and our specialists working in one place.
These terms mean different things. Do not blur them:
- Scheduled testing
- assessments carried out at agreed times.
- Automated scanning
- software checks for known weaknesses. It can run often, but it cannot judge business logic.
- Manual testing
- a specialist investigates and tries to exploit weaknesses.
- Continuous monitoring
- watching systems all the time. Do not claim it unless it is confirmed.