Security testing services
Security testing means somebody outside your team attacks your software on purpose, with your permission, and writes down every way in. We do that for web applications, APIs and mobile apps. Scanners do the breadth and people do the depth, and what you get back is a list of real problems with a fix for each, not a scanner export.
We are an independent testing company. We have tested other people's software since 2018, we did not write yours, and we have no development contract to protect by staying quiet about what we find. 50+ engineers, in Cluj-Napoca, Romania.
Two weeks, free if you are not happy with what we deliver. We invoice from week three.
Who this is for
- You are about to launch, raise, or sell to a bigger customer. Somebody is going to ask how you know the product is secure, and you would like the answer to be a report rather than a hope.
- You ship fast and nobody on the team owns security. The code goes out weekly or daily, much of it written with coding assistants, and review capacity did not grow to match.
- A customer's questionnaire is sitting in your inbox. You need evidence that someone independent tested the product, and what they found, and that it was fixed.
- You had a scanner report and did not trust it. Four hundred findings, most of them noise, and no way to tell which three matter.
- You need a security tester for a few weeks, not a hire. A specialist can join your account for a fortnight without us recruiting for it.
What we test
- Web applications. The OWASP Top 10, and then the part scanners cannot see: business logic. Can a user apply a discount twice, change a price in the request, or skip a step in a workflow that was supposed to be enforced?
- Authentication and permissions. Every user role, tested as that role. Can one customer read another customer's data? In a multi-tenant product that is the finding that matters most, and no scanner will find it for you.
- APIs. REST and GraphQL. Payload modification, header manipulation, token and session handling, and what happens when the API receives something it did not expect.
- Traffic in transit. Man-in-the-middle analysis of what the app sends and whether it checks who it is talking to.
- Your code and its dependencies. Static analysis of the source, known vulnerabilities in the libraries you ship, and credentials committed to the repository or its history.
- Mobile apps. iOS and Android builds, alongside the APIs they call.
- Features built on language models. If your product passes user input to an LLM, we test it for prompt injection, jailbreaks and data it should not disclose.
- Cloud and infrastructure. Your AWS and Kubernetes setup and the code that builds it: who and what can reach what, deploy permissions, exposed keys and risky defaults.
How we work
We start with a scoping call. You tell us what the product does, who uses it, and what you are most worried about, and we map the attack surface with you: which URLs, which APIs, which user roles, which environments. For authenticated testing we need test accounts at each role.
Then two things run side by side.
The automated pass. The AI Security Toolkit is the tool we built for this. It runs a set of open-source scanners in one pass (Semgrep, Trivy, Nuclei, sqlmap and gitleaks among them, with OWASP ZAP in the wider security work) and correlates their findings with checks we wrote ourselves for what off-the-shelf tools skip. Correlating matters: two medium findings that chain together are one critical one, and a scanner reading them separately will not tell you.
The manual pass. An engineer works through the product the way an attacker would, starting with the things the scanners are weakest at: permissions, business logic, the order of steps in a flow.
Nothing reaches your report on a scanner's word alone. Every critical finding is checked by a person and reproduced before it goes in.
What you get
- Findings you can act on. Each one with its severity, the steps to reproduce it, proof that it is real, and the fix at the level of your code rather than a link to a CVE.
- The chains, not just the parts. Where findings combine into something worse, the report shows the path from the first step to the damage.
- A summary your management can read, separate from the detail your developers need.
- A shared place to track it. Findings go into BugBoard, so your team sees them as they are confirmed rather than waiting weeks for a PDF.
When an engagement ends, you keep the reports, the documentation and the tooling configuration.
What it costs
$25 to $45 an hour.
The rate moves with the seniority of the engineer, how long you commit for, and the mix of work. Security testing sits in the specialist part of that mix. Longer commitments move down the range. The tools come with the engagement, with no separate licence cost. Retests are billed at the same hourly rate as any other testing time.
We start the same way on every engagement. Two weeks, free if you are not happy with what we deliver. We invoice from week three.
When we are not the right answer
We would rather say this here than on the third call.
If the work needs a security clearance or involves classified material. We hold no clearance and we do not take that work.
Where the contract requires staff on site, or nationals only. Common in defence and parts of healthcare. We are in Romania and work remotely, so that is a straight no.
If you need a SOC 2 report. We do not issue one; a licensed auditor does. We can run a SOC 2 readiness check that maps your security posture against the 61 Trust Service Criteria and returns a gap report before you engage the auditor. Our own SOC 2 status: ready, not yet audited.
If you want a clean report more than a secure product. We write down what we find. If the goal is a document that says nothing is wrong, we are the wrong supplier.
Why us
Anthropic. Anthropic approached BetterQA and we provided our security testing work.
We are independent. We did not write your code and we are not selling you the fix. A supplier who built the product and then tests it is not giving you a second opinion.
We have tested products that handle sensitive data. AdviNow Medical, a clinical decision support platform in Arizona, is one: security assessments sat alongside HIPAA compliance testing.
ISO/IEC 27001:2022 covers how we handle your data, credentials and test environments, which is the first thing to ask a security tester about. We also hold ISO 9001:2015, ISO 13485:2016 and ISO 14001:2015, all current to 05.12.2027. We send the certificates with their scope statement.
A NATO procurement agreement. The NATO NCIA Basic Ordering Agreement, NCAGE 1JGAL. It is a signed ordering agreement, so NATO bodies can order from us on terms already agreed. It is not a certification and it is not a clearance.
4.9 on Clutch, from more than 65 reviews. Written by clients, not by us.
Common questions
Is this a penetration test?
Yes, combined with automated scanning. The scanners cover breadth, and an engineer tests by hand where scanners are weak: permissions, business logic and chained findings.
What do you need from us to start?
For external testing, the URLs or API endpoints in scope. For authenticated testing, test accounts at each user role and whatever API documentation you have. Nothing to install on your side.
Will you test production?
Only if you want us to and we agree the limits in writing first. A staging environment that matches production is safer and usually just as useful.
Which standards do the reports map to?
The OWASP Top 10 as standard. Tell us on the scoping call if your customer or auditor asks for a specific framework.
How do you handle what you find?
Under NDA, inside the ISO 27001 management system, and shared only with the people you name. For a regulated product, ask for the scope statement rather than the certificate.
Talk to us
Tell us what you ship, who uses it and what worries you. We will tell you what we would test first, and if the honest answer is that a scanner and a weekend would do, we will tell you that instead.