Before implementation
Review a sensitive flow, its trust boundaries and likely abuse cases.
After the assessment
Security reviews between full pentests.
An independent tester who already knows your product, called in when a sensitive feature changes or a fix needs retesting.
- Best fit
- After an assessment
- A known product, team and risk profile.
- Timing
- Booked when needed
- Before a release, or after a fix.
- Scope
- One change
- Agreed before the review starts.
When to use it
When the product changes after a pentest.
One new permission model or integration rarely needs a full pentest.
We agree a smaller review around that change, including what evidence you will get. If the change is big enough to need a full pentest, I will tell you on the scoping call.
Before release
Test the changed path, or retest a fix, and record what was verified.
An example
Shareable links added two months after the pentest.
The product was tested in March. In May the team adds links that let users share a document with someone outside their account.
- Scope the change
The review covers who can open a shared link, and whether access ends when the link is revoked.
- Test before release
The new flows are tested on staging, and each finding is reported with evidence and a fix.
- Retest the fixes
Once the fixes ship, the same paths are tested again and the report records what was verified.
Reviews and full pentests
When a full pentest is still needed.
A review looks at one change. A full pentest looks at the product as a whole, including how changes interact and the paths an attacker can chain across features. Reviews work best between full pentests and keep the last report current until the next one.
A review
One change before release, or the retest of a fix.
A full pentest
The whole product in scope, after major changes or when many changes have built up since the last test.
Outside this service
Running your security programme, or on-call cover.
Common questions
Questions about reviews between pentests.
How is a review different from a full pentest?
A pentest covers the whole product in scope. A review covers one change, so it is shorter, and its report only speaks for that change.
What do you need to scope a review?
The change and how it works, the release date, test access and the previous report if there is one.
Can reviews be booked as a plan?
Yes. Reviews can be booked one at a time, with nothing billed between them, or as an annual plan: one full pentest plus a set number of review days, agreed upfront.
Can a review retest fixes from the last pentest?
Yes. Retesting the fixes for findings in the last report is one of the most common reviews, and the result is recorded against the original findings.
Other services
Where the work usually starts.
Web, API & mobile penetration testing
A test of your web app, API or mobile app, the cloud it runs on and any device that connects to it.
Finding validation
Findings from scanners, AI tools or earlier assessments, checked one by one in your code. You learn which are real and how to fix them.
When a verified fix requires production code, remediation engineering is available as a scoped add-on.
Tell me what changed since the last test.
Send the change, its release date and the previous report if there is one.
Prefer to write directly? [email protected]