All services
Eleven ways in. One Sumrite report out.
One service at a time. It advances on its own, or use the arrows. Swipe the card on a trackpad or phone.
Which penetration testing service do you need?
Sumrite offers nine expert-led security testing services. Each one is a penetration test or assessment carried out by a researcher, not a scanner, and each ends in the same kind of report: an executive summary, every finding rated by CVSS severity with evidence and steps to reproduce, and a fix your engineers can apply. Re-testing of fixed issues is included on standard engagements. The services differ in what they target. Web application, API and mobile testing cover the software your customers use. Network and cloud assessments cover the infrastructure it runs on. Source code review and thick client testing cover code and desktop software that runtime tests cannot fully see. Phishing simulations and red team operations test people, process and detection. Every engagement starts the same way: a fixed-price quote and an NDA before any technical detail is shared.
Sumrite services compared
| Service | What it tests | Usually needed for |
|---|---|---|
| Web Application VAPT | Websites, SaaS apps, customer portals | A buyer's security review, SOC 2 or ISO 27001 audit, or a launch |
| API Security Testing | REST and GraphQL APIs behind web and mobile apps | Partner integrations, a public API, or multi-tenant data |
| Mobile App VAPT | iOS and Android apps and their backend | An app store release, a bank or healthcare client review |
| Network VAPT | External perimeter and internal networks | Insurance, ISO 27001, segmentation or ransomware-readiness checks |
| Cloud Security Assessment | AWS, Azure and Google Cloud accounts | Fast cloud growth, a customer cloud questionnaire, or an audit |
| Source Code Review | Application source code | Critical releases, payments or crypto code, or due diligence |
| Thick Client VAPT | Desktop applications (.NET, Java, Electron, native) | Rolling software out to enterprise or regulated desktops |
| Phishing Simulations | Your staff and email controls | Awareness programme evidence for ISO 27001, SOC 2 or PDPL |
| Red Team Operations | People, process and detection tools | A mature programme testing whether attacks are detected |
| IoT & Hardware Security Testing | Connected devices, firmware, debug ports, radio links, automotive ECUs and their app and cloud | Launching smart, medical, industrial or automotive hardware, and EU Cyber Resilience Act readiness |
| Continuous Pentesting (PTaaS) | Web apps and APIs release by release, CI/CD pipelines, containers, Kubernetes and infrastructure as code | Teams that ship weekly and need current evidence, a live findings portal and Jira or GitHub tracking |
All eleven services
Web Application VAPT
Logins, checkout, and the admin door. We walk them the way a buyer’s attacker would, then write it so engineering can fix it.
API Security Testing
The button is not the boundary. We change the id, replay the token, and call the route the screen never drew.
Mobile App VAPT
The install is only half the product. We look at what the phone stores, what it trusts, and which API it calls in the background.
Network VAPT
A quiet host is still a door. We map what answers from the outside and what an insider can pivot through next.
Cloud Security Assessment
One role, one bucket, one key left in a build. That is usually the door. We look for the setting that makes a private cloud public.
Source Code Review
Green tests do not mean a safe login. We read the checks a scanner skips: who can see which record, and what the code believes.
Thick Client VAPT
The desktop app trusts whoever is sitting in front of it. We do not. The binary, the local files, and the server still have to agree.
Phishing Simulations
Most breaches start with one convincing message. We run authorised phishing campaigns and show who clicks, who reports, and how far a real lure would get.
Red Team Operations
A list of bugs is not a path to the goal. We start from the outside and show what a motivated team can actually reach.
IoT & Hardware Security Testing
An attacker can buy your device and open it on a desk. We do the same: debug ports, firmware off the chip, radio links, updates and the cloud behind it.
Continuous Pentesting (PTaaS)
A yearly report describes last year’s product. We test as you ship, show every verified finding in your portal and push it to Jira or GitHub.
Choosing a service: common questions
Which security test do I need first?
Start with what your customers or auditors are asking about. For most SaaS companies that is a web application test, usually combined with the API behind it. Add mobile, cloud or network testing when those are part of what you sell or where your data lives.
How long does a Sumrite engagement take?
For a scoped web application or API, the report is delivered within 48 hours of testing starting. Network, cloud, red team and larger multi-service engagements take longer; the timeline is confirmed in the fixed-price quote before work begins.
Is re-testing included?
Yes, on standard engagements. Once your team has fixed the findings, they are tested again and the report records which issues are now closed.