Quick answers about our penetration testing services.

A typical engagement includes scoping, hands-on testing of agreed systems, a formal VAPT Report with prioritized findings and remediation guidance, and optional retesting with a Letter of Attestation or closure report.

No. Penetration testing does not issue an official security certification for your app. Digital Software Labs provides a formal VAPT Report and, after retesting, a Letter of Attestation (or closure report).

Yes. Digital Software Labs is CREST certified. CREST is a global accreditation body for cyber security services and professionals, helping organisations engage reputable, competent providers.

Most assessments take one to three weeks depending on scope, system complexity, and access arrangements. We’ll confirm a timeline during scoping.

Usually a short briefing on objectives, in-scope systems, environment access details, and any constraints such as testing windows or production sensitivity.

We design testing to minimize operational impact. Sensitive checks can be scheduled, throttled, or limited based on your risk tolerance and agreed rules of engagement.

Yes. Many engagements start in staging and, where approved, include carefully controlled production testing. We’ll agree the approach during scoping.

Yes. We can execute an NDA and define rules of engagement before any assessment begins.

We assess authentication, session handling, access control, injection risks, business logic flaws, and client-side attack surfaces across customer-facing and internal web apps.

Yes. We test modern web stacks including SPAs and API-driven frontends, focusing on both UI workflows and the backend services they rely on.

Yes. With agreed test accounts and roles, we evaluate privilege boundaries, sensitive workflows, and post-login attack paths.

Yes. Our web testing covers common and advanced web risks aligned with industry practices, including OWASP-relevant categories where they apply to your stack.

Yes. We assess native and hybrid mobile applications on iOS and Android, including client-side risks and related backend/API interactions.

We review insecure local storage, weak transport protections, authentication weaknesses, reverse-engineering exposure, and unsafe handling of sensitive data.

Source code is optional. We can perform black-box or gray-box mobile testing. Providing builds, test accounts, and architecture context improves coverage.

Yes. Enterprise, beta, or privately distributed builds can be included when you provide installable packages and access instructions.

We test REST and GraphQL APIs for authentication, authorization, data exposure, rate-limit gaps, and insecure integrations across critical endpoints.

Yes. Authorization and object-level access control are a core focus of our API assessments.

Typically API documentation or collections, authentication details, staging or agreed environments, and sample identities or tokens for role-based testing.

Yes. Many engagements combine API testing with web or mobile assessments so frontend and backend risks are reviewed together.

We assess networks, servers, and key services for misconfigurations, exposure, hardening gaps, and pathways that could enable lateral movement.

Yes. Cloud and hybrid infrastructure can be included when scope, access, and permissions are clearly defined during kickoff.

Yes. We can perform external exposure assessments and, where authorized, internal network and service reviews.

Yes. Findings include practical remediation and hardening guidance for operations and security teams.

We follow four stages: Scope, Assess, Report, and Retest—so objectives stay clear and outcomes remain actionable.

A VAPT Report is your formal Vulnerability Assessment and Penetration Testing report. It includes an executive summary, prioritized findings, evidence, and remediation guidance.

After retesting, we can issue a Letter of Attestation (or closure report) summarizing verified fixes and closure status for agreed findings. It is not an official security certification of your app.

Yes. After your team remediates findings, we retest agreed items to verify fixes and support closure documentation.

Reports are delivered securely to your nominated contacts. We can tailor executive and technical views for different audiences.

Yes. Many clients share executive summaries, VAPT Reports, or Letters of Attestation with stakeholders under their own confidentiality controls.

Findings are ranked by severity and business impact so your team can sequence remediation effectively.

Yes. We can align scope and reporting to support compliance or due-diligence needs, while remaining clear that VAPT outputs are not an official app certification.