Web Application Security Audit
Web application security audit for websites, portals and web apps
Testing of your web application against OWASP guidance, with a certificate that names the URLs, dates and build covered.
- Valid for
- 1 year
- Guidelines
- CERT-In
- Verification
- QR and register
Accredited and empanelled
What is Web application security audit?
A web application security audit tests a site, portal or web app for the weaknesses attackers use most: broken access control, injection, insecure authentication and misconfiguration. Our auditors combine automated scanning with manual testing, so business logic flaws that scanners miss are found as well.
Testing follows the OWASP Top 10 (2021), the OWASP Application Security Verification Standard 4.0 and the SANS CWE Top 25, alongside any standards your customers name. Once findings are fixed and re-tested, the certificate records the application name, the URLs audited, the audit dates, the hosting environment and the hash of the audited build.
Customers, partners and procurement teams often ask for evidence of independent testing before they connect to or rely on a web application. A dated certificate with a report reference gives them that evidence without exposing the detailed findings.
Who it is for
- SaaS companies answering customer security questionnaires
- E-commerce and online payment businesses
- Banks, NBFCs and fintechs with customer portals
- Healthcare providers with patient portals
- Agencies and developers handing over applications to clients
What sets audit time and cost
Typically two to three weeks from scoping to certificate for a single application, longer when there are many roles, APIs or rounds of re-testing.
- Number of user roles and distinct workflows
- Number of URLs, subdomains and API endpoints
- Authenticated versus unauthenticated testing
- Complexity of business logic such as payments or approvals
- Number of re-test rounds
- Testing windows and environment restrictions
Why it matters
What Web application security audit gives you
- 01
Evidence for customers
A certificate you can share with customers and auditors, while the full report stays confidential.
- 02
Logic flaws found, not only known bugs
Manual testing of workflows such as checkout, approvals and account recovery uncovers issues automated scans cannot see.
- 03
Prioritised fixes
Findings are rated by severity with evidence and remediation guidance, so engineering time goes to the risks that matter.
- 04
Confirmed closure
Re-testing confirms each fix before the certificate is issued, so the certificate reflects the application as it stands.
The audit
What our auditors examine
- 01
OWASP Top 10 (2021)
Each category, from broken access control to server-side request forgery, tested against the application's real functions and roles.
- 02
APIs behind the front end
REST and GraphQL endpoints called by the application, including object-level authorisation, rate limiting and mass assignment.
- 03
Authentication and access control
Multi-factor flows, password reset, session management, privilege escalation between roles and access to other users' data.
- 04
Business logic
Price and quantity tampering, workflow bypass, race conditions and abuse of features such as coupons, referrals or approvals.
- 05
Client-side security
Cross-site scripting, content security policy, third-party scripts, cookie flags and sensitive data stored in the browser.
- 06
Hosting and TLS configuration
Certificates, protocol versions, security headers, exposed files and cloud storage buckets linked from the application.
How the audit runs
Audits follow CERT-In guidelines from scoping to the final certificate, with re-testing until findings are closed.
01
Scoping
We agree the applications, URLs, APIs, networks or assets in scope, the test environment and the rules of engagement.
02
Testing
Auditors test against CERT-In guidelines and recognised methods such as the OWASP Testing Guide, using automated tools and manual techniques.
03
Findings report
Each finding comes with its severity, evidence and the risk it poses. Your team fixes them in the audited environment.
04
Re-testing
We re-test until findings are closed or formally accepted, and record the version that was finally audited.
05
Certificate and report
The final report and certificate are issued, and the certificate is listed in the public register with a QR code for verification.
Related standards and audits
Often certified or audited alongside this one, sometimes in a single combined audit.
Security audits
Safe-to-host certificate
A security audit to CERT-In guidelines, ending in a certificate tied to the exact build you will host.
Security audits
VAPT
Vulnerability scanning followed by hands-on exploitation, so you know which weaknesses an attacker could use.
ISO certification
ISO 27001
Independent certification of your information security management system against ISO/IEC 27001:2022.
Security audits
Data protection compliance
An independent check of how your organisation collects, uses, protects and deletes personal data.
Industries we audit for
SaaS and cloud
Independent evidence that answers enterprise security reviews and keeps sales moving.
Banking and fintech
Audits and certifications that support the security evidence regulators, partner banks and payment networks ask for.
Healthcare and life sciences
Quality and information security certification for organisations where patient safety and patient data both matter.
Guides
5 min read
Preparing for a CERT-In empanelled security audit
A security audit by a CERT-In empanelled organisation goes faster and says more when the auditee is prepared. This checklist covers scope, environments, access, evidence, fixes and the final report.
5 min read
From scoping to safe-to-host certificate
Many government and public sector hosting environments ask for a safe-to-host certificate before an application goes live. This guide walks through each step and explains why the audited build is identified by its hash.
Web application security audit questions
We audit; we do not consult.
To keep audits independent, we never design, build or fix the systems we audit, and decisions are made by people who did not take part in the audit. Read our impartiality policy.
Plan your Web application security audit audit
Tell us your scope, sites and timeline. We reply with an audit plan and a fixed quote.