Web applications & APIs
Test the boundaries between users, roles and data. Explore authentication, authorization and business logic in the workflows that matter to your product.
Customer portals
SaaS products
Internal applications
Penetration testing
Find the
weaknesses.
Know what to fix.
Hands-on security testing for your applications, APIs and infrastructure. Understand what an attacker could exploit and give your team a clear path to remediation.
01 / FINDING EXCERPTWEB-01
Medium · 4.3CVSS v3.1 · CWE-639
One account. Another customer’s invoice.
A standard user changed an invoice ID in a request and received billing data belonging to another organization.
- Risk
- Billing contacts and outstanding balances exposed across tenant boundaries.
- Remediation
- Verify tenant membership and invoice permissions on every request.
Clear remediation stepsRisk ratings without exaggerationResponsive communication throughout
01 / What I test
Start with the systems
your business depends on.
Whether you’re preparing for a release, responding to a customer’s security review, or investigating a specific concern, the engagement starts with your objectives.
Networks & infrastructure
Assess exposed services and internal attack paths. Understand how weaknesses could combine to give an attacker access to critical systems.
External exposure
Internal networks
Security boundaries
Mobile & desktop applications
Review the application alongside the services it trusts. Scope testing around sensitive data, local controls and communication with backend systems.
Mobile applications
Thick clients
Connected APIs
Unsure what belongs in scope? Start with what you’re trying to protect.
02 / What you receive
A report your team
can act on.
Technical detail for the people fixing the issues. Clear context for the people deciding what happens next.
View an example findingExecutive summary
What was tested, the meaningful risks, and where to focus first.
Evidence & reproduction steps
Affected components, observed behavior and the steps needed to reproduce each finding.
Practical remediation guidance
Recommendations tied to the underlying weakness and its impact on your environment.
Scope & testing limitations
A clear record of coverage, assumptions and constraints, so the results have context.
03 / The process
Know what happens next.
You work directly with the person performing the assessment, from the first scoping conversation through the findings discussion.
- 01
Define the engagement
Agree the objectives, systems, access, boundaries, schedule and price. Confirm reporting and retesting expectations before testing begins.
- 02
Investigate attack paths
Combine hands-on investigation with tooling suited to the scope. Validate findings and communicate significant issues during the engagement.
- 03
Report & follow through
Review the evidence, impact and recommended fixes together. Any follow-up testing follows the terms agreed in your scope.
04 / Your tester
Anthony Gibbs.
Offensive security engineer.
Former U.S. Army Black Hawk pilot.
A decade of offensive security experience, with a practical approach to finding and explaining risk.
My experience includes extensive enterprise penetration testing and testing client environments at a compliance firm near Washington, DC. Across both roles, I conducted hundreds of pentests and delivered critical risk findings to clients.
That work was done before AI became part of the pentesting workflow. Today, I work on an autonomous AI penetration testing platform, bringing that hands-on experience to bear on where tools help and where human judgment matters.
Before security, I flew Black Hawk helicopters in the U.S. Army, including combat deployments. Preparation, precision and calm execution still shape how I work.
Independent practice. Direct communication.
Before we start
A few useful details.
How much does a pentest cost?
Pricing depends on the size and complexity of the scope, the access available and the objectives. Send a short description of your environment and deadline to start a scoping conversation. You’ll agree the price before testing begins.
How long does an engagement take?
The testing window and report delivery date are agreed during scoping. Application size, user roles, environments and access requirements all affect the schedule. Mention any customer, release or audit deadline in your initial email.
Is retesting included?
Retesting coverage, timing and any additional cost are agreed in the engagement scope. We’ll establish those expectations before the initial assessment.
How are AI tools used?
Testing is led by an experienced practitioner. Tooling supports investigation; findings need evidence and human judgment. Any proposed AI use and how it would handle your data should be agreed as part of scoping.
Can testing support a customer or audit request?
Share the requirements with your initial inquiry so we can assess the fit and agree the relevant scope and report deliverables. A pentest documents the results of an assessment; it doesn’t guarantee certification or satisfy every third-party requirement.
Let’s define the scope
What needs
a closer look?
Send a few details about your environment and what you need from the assessment. I’ll help you work out the right scope.
Discuss your pentestOr email tony@infil.sh
A useful first email
- Your company and your role
- The applications or systems to test
- What’s driving the assessment
- Your target timing
A high-level description is enough to start. We can arrange the exchange of sensitive details separately.