02 / PENETRATION TESTING

Product Penetration Testing

Product software / platform in scope

Penetration testing of the software and infrastructure that form part of the product, web and mobile applications, APIs, cloud-native backends, Kubernetes, management interfaces and network services.

We follow attack paths across application, identity, backend and infrastructure boundaries rather than treating each component as an isolated test target.

WebMobileAPIsCloud BackendsKubernetesNetwork Services
PRODUCT / PLATFORM ASSESSMENT SURFACE
attack path note attack path: WEB → API → IAM → BACKEND → KUBERNETES
WEB APP / CLIENT
session handling inspect
client trust under test
privileged functions mapped
input validation in focus
PRODUCT ATTACK SURFACE

One product. Multiple application and infrastructure boundaries.

Product security rarely stops at the frontend. Authentication decisions in an API can affect backend services. A compromised application account may expose management functions. Kubernetes identities and secrets can turn an application flaw into infrastructure access.

layer selected
API / Management
Product APIs, management APIs, authorization, object access and business logic.
ASSESSMENT SURFACE

What we test

Applications

Web applications, mobile applications, management interfaces, privileged product functions and client-side trust assumptions.

APIs & authorization

Authentication, authorization, object access, privilege boundaries, business logic and management APIs.

Identity & session trust

Sessions, tokens, device/user identity, federation, service identities, role models and privilege transitions.

Backend services

Product services, internal APIs, message flows, service-to-service trust and backend business logic.

Kubernetes & cloud-native runtime

RBAC, service accounts, workload identity, namespace boundaries, exposed services and paths from application compromise into the runtime.

Secrets & network services

Credentials, tokens, secret exposure, management ports, network protocols and infrastructure services that form part of the product.

The exact assessment surface follows the product architecture. Not every engagement needs every layer.

CROSS-LAYER ATTACK PATHS

The interesting findings often sit between components.

01

Application → API → Administration

A low-privilege application account reaches an API operation that exposes a management function intended only for administrators.

02

API → Identity → Backend

An authorization weakness allows access to another tenant or product instance. Backend trust turns a single API flaw into cross-customer impact.

03

Application → Kubernetes → Secrets

An application compromise reaches a workload identity with excessive permissions. The original application flaw becomes access to product secrets or internal services.

SCOPING

Scope follows the product architecture.

Architecture

Applications, APIs, backend services, identity systems, Kubernetes, network services and external dependencies relevant to the product.

Attacker assumptions

Unauthenticated user, authenticated customer, low-privilege account, compromised client, network access or another agreed starting position.

Technical depth

We select the attack paths and test methods needed to answer the actual product-security question rather than dividing the system into unrelated test packages.

A complete architecture package is not required before the first conversation.

DELIVERABLES

What you get

Reproducible findings

Steps, requests, evidence and affected components sufficient for engineering teams to reproduce the issue.

Technical impact

What the weakness enables under the agreed attacker assumptions.

Attack-path context

How application, API, identity and infrastructure weaknesses combine across the product.

Remediation & retest

Technical remediation context and verification of fixes against the original attack path where retesting is in scope.

FINDING 07
Workload identity exposes product secrets
ACCESS
authenticated product user
PATH
API → backend service → workload identity → secrets
IMPACT
access to service credentials
STATUS
reproducible
Typical triggers

When this assessment fits

New B2B software product or platform before release
Major application or backend architecture change
New API or management interface
New Kubernetes or cloud-native product runtime
New identity, tenant or privilege model
Customer security-assurance requirement
Existing product that has only received isolated web or infrastructure tests
Need to understand whether an application finding can reach backend or infrastructure layers
PRODUCT SECURITY REQUIREMENTS

Need the assessment to support a regulatory requirement?

Where required, assessment scope and findings can be mapped to relevant technical requirements from the CRA, EN 18031 and IEC 62443.

CRAEN 18031IEC 62443
Technical testing and evidence. Certification is outside the scope.
IN THE LAB

From finding to a provable attack path.

A pentest finding counts when it holds on the device: reproducible, with clear conditions and technical impact. For that, the device runs on our bench, its interfaces are attacked deliberately, and the firmware is analysed where its protection does not hold.

Our lab methodology matches the one described with service 01, deepened on the attack side. The details of what happens there are covered with service 01; what matters here is the standard: a finding is only reported once it holds up on the product.

Dr. Ewan Fleischmann
Technical direction

Dr. Ewan Fleischmann

Founder · Product Security & Cryptography

22+ years IT security · PhD cryptography · OSCP · OSCE · CISSP

Building a product that needs serious security testing?

Tell us what you're building, the current development stage and what you want tested. The scope follows from the product.

NDA first if required.