Guide · web apps and APIs
Web application and API testing.
A web application pentest attacks your app the way a user with bad intentions would: logged in, as every role, through the browser and the APIs behind it. Scope it by roles and endpoints, insist on authenticated testing, and ask for the OWASP testing guide as the method.
Five things to settle before the test
Roles
Test as each kind of user (anonymous, customer, admin, tenant A vs tenant B). Most serious findings are one user reaching another’s data.
Environment
Staging that mirrors production, or production with agreed limits. Name what must not be touched.
APIs
List every API the app uses, including mobile and partner ones, with documentation or a collection file.
Business logic
Payments, refunds, approvals, coupons, invitations: flows a scanner can’t reason about.
Standard
OWASP Web Security Testing Guide for method, OWASP Top 10 and API Security Top 10 for coverage.
Firms that list web application or API testing
| Firm | Type | Pricing | Retest | Sample report |
|---|---|---|---|---|
| Decima Systems Ours | Hybrid | Published | Published | OpenSynthetic example: no live assessment was performed |
| Astra Security | Hybrid | Published | Published | Open |
| Synack | PTaaS platform | Published | Published | Open |
| Bugcrowd | PTaaS platform | Not stated | Published | Open |
| Cobalt | PTaaS platform | Published | Published | Not stated |
| Horizon3.ai | Autonomous / AI | Published | Published | Not stated |
| Pentera | Autonomous / AI | Not stated | Published | Open |
| Praetorian | Hybrid | Published | Published | Not stated |
| Raxis | Consulting firm | Published | Published | Not stated |
| RunSybil | Autonomous / AI | Not stated | Published | Open |
| Bishop Fox | Consulting firm | Not stated | Published | Not stated |
| BreachLock | PTaaS platform | Not stated | Published | Not stated |
| HackerOne | PTaaS platform | Not stated | Published | Not stated |
| IOActive | Consulting firm | Not stated | Published | Not stated |
| Kroll | Consulting firm | Not stated | Published | Not stated |
| NCC Group | Consulting firm | Not stated | Not stated | Open |
| NetSPI | PTaaS platform | Not stated | On request | Open |
| Packetlabs | Consulting firm | Not stated | Published | Not stated |
| Secureworks (Sophos) | Consulting firm | Not stated | Published | Not stated |
| Terra Security | Hybrid | Not stated | Published | Not stated |
| TrustedSec | Consulting firm | Not stated | Published | Not stated |
| Trustwave SpiderLabs (now LevelBlue) | Consulting firm | Not stated | Published | Not stated |
| XBOW | Autonomous / AI | Not stated | Published | Not stated |
| Black Hills Information Security | Consulting firm | Not stated | On request | Not stated |
| Coalfire | Consulting firm | Not stated | Not stated | Not stated |
| Mandiant (Google Cloud) | Consulting firm | Not stated | Not stated | Not stated |
| Optiv | Consulting firm | Not stated | On request | Not stated |
| Rapid7 | Consulting firm | Not stated | Not stated | Not stated |
| Rhino Security Labs | Consulting firm | Published | On request | Not stated |
From each firm’s own service pages, checked November 8, 2026.
Questions
How long does a web application pentest take?
Typically one to three weeks of testing for a single application, depending on the number of roles, pages and API endpoints. Firms usually scope it on a call or from a questionnaire.
Should the test be authenticated?
Yes, for almost every application. Unauthenticated testing only sees the login page and public content; most serious findings involve one logged-in user reaching data or actions they should not.
Is the API tested separately?
Usually in the same engagement, if you list it in scope. Ask for API endpoints to be named in the report so you can see what was covered.
Sources for this page
- OWASP Web Security Testing Guide — The usual method for a web application test.
- OWASP Top 10 — The common reference for web application risk categories.
- OWASP API Security Top 10 — The API risk categories, such as broken object level authorization.
How firms are chosen, what counts as "published" and how to send a correction: methodology.
Cite this page
Pentesting Firms. "Web application and API penetration testing: scope, method and firms." Updated November 8, 2026. https://pentestingfirms.com/web-application/