BetterQA

For teams who need to know what an attacker could do with their product

Penetration testing services for web apps, APIs and mobile apps

We attack your web application, API or mobile app on purpose, with your permission, and write down every way in. Scanners cover the breadth. Engineers test by hand where scanners are weak: permissions, business logic and findings that chain together. You get real problems with a fix for each, not a scanner export.

€20-45Per hour

OWASPTop 10, API, MASVS

ISO 270012022, valid until 21.10.2029

Since 2018Independent testing

Scope a pentest Email office@betterqa.co

Reviewed by Tudor Brad, Founder & CEOCompleted the DNSC-authorised Cybersecurity Auditor programme (2026) · ISTQB Certified Tester (Foundation Level) · Engineering degree, Technical University of Cluj-Napoca · Certified trainer

// In short

What is a penetration test?

A penetration test is an authorised attack on your web application, API or mobile app, run by certified security testers, to find the ways in before a real attacker does. You get every finding with proof, a CVSS severity and a fix, a summary for management, and a retest of the fixes included in the price. Download a sample report.

// 01

What we test

Web application penetration testingThe OWASP Top 10, then what scanners cannot see.

Login, sessions and password reset
One customer reading another's data
Prices, discounts and steps you can skip

API penetration testingREST and GraphQL, against the OWASP API Security Top 10.

Object, property and function level access
Tokens, keys and rate limits
Payloads the API did not expect

Mobile app penetration testingiOS and Android builds, with the APIs they call, using OWASP MASVS and MASTG.

Data stored on the phone
Traffic and certificate checks
Keys and test servers left in the build

Scope: web applications, APIs and iOS and Android apps. We test applications.

// Our own toolkit

Our own security toolkit, run on every pentest

Before an engineer starts the manual pass, our AI Security Toolkit sweeps the app. We built it and we run it, so it comes with your pentest at no extra licence cost.

15 scanners, plus 20 checks we wroteCode, dependencies, secrets, the running app, infrastructure and cloud, plus checks for the problems those scanners miss.

Findings joined into attack chainsResults from every scanner are read together, so two small issues that combine into one serious one reach you as one chain.

Every user role checkedIt signs in as each role and tries what that role should not be able to reach.

Proven on a public benchmarkOn a public vulnerable-by-design benchmark it built six working attack chains. Burp Pro built none.

It runs only against a test environment you have confirmed, and a person verifies every critical finding before it reaches your report. See how the toolkit works.

// 02

VAPT explained: assessment plus penetration test

Vulnerability assessment (VA)Scanners and checks find candidate weaknesses across the whole application, fast and wide. Many of them are false alarms or low risk.

Penetration test (PT)An engineer tries to exploit what the assessment found and looks for what scanners miss, such as broken permissions and business logic. A finding counts only when it is proven.

VAPT is the two together, and that is how we run every engagement: the VA gives breadth, the PT gives proof. You receive the proven findings, not the raw scanner list.

// 03

Methodology

OWASP Top 10
OWASP WSTG
OWASP API Security Top 10
OWASP MASVS / MASTG
PTES
CVSS

01ScopeURLs, endpoints, builds and user roles, agreed in writing.

02Automated passOur AI Security Toolkit runs Nuclei and sqlmap against the running app, adds Semgrep, Trivy and gitleaks when you share the source, plus 20 checks we wrote.

03Manual passAn engineer works through the product as each role, following the OWASP Web Security Testing Guide for web and MASTG for mobile.

04Verify and rateEvery critical finding is reproduced by a person, then scored with CVSS so you can rank the fixes.

Black-box from the outside, or grey-box with test accounts at each role. Two medium findings that chain together can add up to one critical one, and we report the chain. After you fix, we retest.

// Watch

1:26

Is your software really ready for release?

Tudor Brad, founder of BetterQA, on what one faulty release can do, and why the team that built the product should not be the only one testing it.

// 04

What you get: the report and a sample

Findings you can act onSeverity (CVSS), steps to reproduce, proof and the fix at the level of your code.

Attack chainsWhere findings combine, the path from the first step to the damage.

A summary for managementSeparate from the detail your developers need.

Findings as they landIn BugBoard, as each is confirmed, not weeks later in a PDF.

Rules of engagementSigned before testing: what we test, how, when and who to call.

An attestation letterFor your auditor or customer: what was tested, when and by whom.

See what lands on your desk: download a sample penetration test report. It is illustrative: the application, findings and figures are examples.

Download a sample report (PDF)

Want us to walk you through it?

You keep the reports and the tooling configuration when the engagement ends.

// 05

How a pentest works

01Scoping callWhat the product does, who uses it and what worries you.

02NDA, DPA and rules of engagementSigned from day one, before any technical discussion.

03AccessTest accounts at each role, API docs, an app build. Nothing to install.

04TestingAutomated and manual passes side by side, on staging by default. We can start within 1-2 weeks of a signed scope.

05ReportEvery finding with proof and a fix, plus the management summary.

06Retest, includedAfter you fix, we check the fixes hold. The retest is included in the price.

Need it more than once a year? We can run pentests on every major release, as a security tester inside your team.

// Method

How we find and verify each issue

Tools give breadth: every endpoint, dependency and file. Our engineers give judgement: comparing accounts, deciding what an attacker can really reach, removing false positives.

01Map the app and its APIEvery page, every API call and every role, before testing starts.

02Test as several rolesOne admin and two restricted users. Each tries what the others can do.

03Go past the interfaceWe call the API directly. The server, not the screen, decides what a user may see.

04Read the code, if you allow itA read-only copy. We audit dependencies for known CVEs and scan for committed keys.

05A person confirms each oneScanner output is a lead, not a finding. Code-only findings stay marked until reproduced.

06Filed with evidenceIn BugBoard: steps, evidence, severity, impact. After the fix, a check that goes red if it is undone.

Download a sample report (PDF)

Want us to walk you through it?

// 06

How much does penetration testing cost?

€20-45per hour

The hourly rate depends on the engineer's seniority and the mix of work. The size of the test depends on scope: how many roles, endpoints and apps. After a scoping call you get a written proposal with a fixed price for your scope, before any testing starts.

What sets the priceNumber of user roles, endpoints or screens, apps and platforms, and whether you share source code.

Retest includedChecking your fixes is part of the price. No second invoice for the retest.

Tools includedNo separate licence for the toolkit.

The trial month on our team engagements does not apply to a one-off pentest.

// 07

Penetration testing for compliance and audits

Auditors and enterprise customers ask for proof that you test your own security. Our report and attestation letter give you that evidence for:

ISO 27001Evidence of security testing for Annex A controls on testing and technical vulnerability management.

SOC 2Penetration test evidence for your SOC 2 audit, from a tester independent of your developers.

DORATesting evidence for the digital operational resilience of financial entities and their ICT suppliers.

NIS2Evidence for the security testing and vulnerability handling measures NIS2 asks of essential and important entities.

PCI DSSApplication-layer penetration test evidence for cardholder data environments, web and API.

GDPREvidence that you test the security of personal-data processing, as Article 32 expects.

You take the report to your auditor. Rules of engagement are signed first, and the attestation letter states what was tested, when and by whom. For teams that handle card data, see how we test against the PCI DSS requirements.

// 08

Penetration testing for UK companies

Your working dayOur UK team covers the full UK day, 09:00 to 17:00 London time, so calls and questions land in your hours.

Contracts you expectNDA, data processing agreement and rules of engagement signed before testing, reports in English. UK GDPR applies to the data we handle.

For regulated UK teamsFintech and SaaS teams use our report and attestation letter for customer security reviews and audits. A control can exist and still protect almost nothing: in one day-long review every request was signed, but not the part that says what it does.

// 09

Why an independent QA company for your penetration test

IndependentWe only test, so we have no fix to sell and no reason to inflate a finding.

Certified security testersOur security testers hold OSCP, CEH, eWPT/eJPT and ISTQB Advanced Security Tester certifications.

Mythos approvalAnthropic has approved BetterQA to use its Mythos model for security testing.

ISO/IEC 27001:2022Covers how we handle your data, credentials and test environments.

Our own toolkitSix working attack chains on a public vulnerable-by-design benchmark. See the benchmark.

Reviewed by an ISTQB-certified engineer who completed the DNSC-authorised Cybersecurity Auditor programme. NATO NCIA registered supplier (Basic Ordering Agreement, NCAGE 1JGAL). 4.9 on Clutch, from 71 client reviews. For projects that need security-cleared staff, we work with our partner Intensec.

// 10

How to choose a penetration testing company: 5 checks

01Scope fitDo they test your kind of product: web, API or mobile?

02Manual workAsk what a person tests by hand, beyond the scanner run.

03A real reportDownload our sample report. Look for proof, severity and a fix per finding.

04Safe handlingNDA, rules of engagement and an ISO 27001 management system.

05Retest and peopleIs the retest included, and who holds which certification?

We are glad to be checked against all five. download the sample report or book a scoping call.

// 11

Common questions

What do your penetration testing services cover?

Web applications, APIs and iOS or Android apps.

Is VAPT the same as a penetration test?

VAPT is vulnerability assessment plus penetration testing. We do both: scanners find candidate issues, then an engineer proves which ones are exploitable.

How much does a penetration test cost?

€20 to €45 an hour. After the scoping call you get a written proposal with a fixed price for your scope. The retest of your fixes is included.

Which standards do you test against?

OWASP Top 10, the OWASP Web Security Testing Guide, OWASP API Security Top 10, OWASP MASVS and MASTG for mobile, and PTES for the overall process. Findings are scored with CVSS.

Will you test production?

Only if you want us to and we agree the limits in writing first. A staging environment that matches production, with test data, is safer and usually just as useful.

What do you need from us to start?

The URLs, endpoints or app builds in scope, test accounts at each user role, any API documentation, and source code access if you want code and dependency checks.

Do you sign rules of engagement and give an attestation letter?

Yes. We sign rules of engagement before testing starts, and give your auditor an attestation letter when the test is done.

How do you handle what you find?

Under NDA, inside our ISO/IEC 27001:2022 management system, and shared only with the people you name.

Scope your penetration test

Tell us what you ship, who uses it and what worries you. We will tell you what we would test first and what it costs.

Contact us Email office@betterqa.co