Sara Al MCustomer since 2023
Exposed
- Phone
- +971 50 4821
- sara.a@gmail.com
- Card on file
- •••• 7730
One edited link. Any customer's data.
Penetration testing for UAE companies that hold customer data.
We test your web apps, APIs and internet-facing systems. Every finding comes with proof, a severity rating you can defend, and a fix your developers can apply.
- Fixed quote after a scope call
- Written report with a fix for every finding
- Retest once you've fixed
What we test
Scoped to what you actually run
Pick one area or combine several. We agree the scope with you up front, so you know exactly what gets tested and what doesn't.
Web applications
Customer portals, booking systems, dashboards and admin panels, tested the way a real attacker would.
APIs
REST and GraphQL APIs behind your apps and integrations, including the authorisation flaws that scanners miss.
External network
Everything you expose to the internet: servers, VPNs, email, remote access and forgotten subdomains.
Internal network
What an attacker could reach after one phished laptop or a rogue device on your office Wi-Fi.
Cloud configuration
A review of your AWS, Azure or Google Cloud setup: who can access what, what's publicly exposed, and what's logged.
Mobile apps
iOS and Android apps and the backends they talk to, from stored data to network traffic.
How an engagement runs
From scope to retest
You always know what's being tested, when, and who to call if something looks off.
01
Scope
We agree what's in scope, test windows and emergency contacts, and send a fixed quote.
02
Testing
Tooling for coverage, then hands-on testing to chain issues together and show real impact.
03
Report
A written report with an executive summary, proof for each finding, and fixes ranked so your team knows what to tackle first.
04
Retest
Once you've fixed, we retest and issue an attestation letter confirming what's closed.
Where we spend our time
The serious issues are usually logic and access-control flaws: one customer reaching another's data, a payment step that can be skipped, an admin action anyone can call. Scanners don't find these. That's where most of our testing goes.
What you get
A report both your board and your developers can use
- Executive summaryPlain-language risk overview for leadership. No jargon.
- Proof for every findingSteps to reproduce, evidence and business impact.
- Prioritised fixesScored with CVSS, mapped to OWASP, with fix guidance for your stack.
- Attestation letterConfirmation of what was tested and what's been fixed, for auditors, insurers and your own clients.
Executive summary
Example
Web application & API assessment
Findings by severity
0Critical
4High
5Medium
4Low
AR-003Customer records readable by any userHigh
AR-001Admin panel reachable from the internetHigh
AR-007Password reset link never expiresHigh
AR-010No rate limit on login attemptsMedium
AR-012Verbose error messages reveal stackLow
Illustrative example, not a client report.
FAQ
Common questions
Something else on your mind? Ask us on the scope call.
Will testing break our live systems?
We agree test windows and off-limits actions up front, avoid destructive techniques on production, and keep a direct line to your team throughout. If anything looks unstable, we stop and call you.
How long does a test take?
Most single-application or external network tests take one to two weeks from kickoff to report. The scope call gives you a firm timeline and a fixed quote.
What's the difference between a vulnerability scan and a pentest?
A scan is an automated tool checking for known issues, such as outdated software. A pentest is a person working through your systems to find what tools miss, like access-control and business-logic flaws, and proving what an attacker could actually do with them. Scans are useful between tests, but they don't replace one.
What do you need from us?
A list of what's in scope, a technical contact, and test accounts if you want authenticated testing. We send a short checklist after the scope call.
How do you handle our data?
We access only what's needed to prove a finding, redact personal data in reports, keep engagement data stored in the UAE, and delete it at the end of the engagement.
Get started
Know where you're exposed.
Book a 20-minute scope call. We'll ask what you run, recommend what to test, and send a fixed quote.