# Security audit and penetration test > An attacker's view of your application and infrastructure, and a fix list you can act on. - Page: https://deependra.in/services/secure/security-audit - Type: Service, part of Security and compliance engineering - Last updated: 2026-11-02 - Line page: [Security and compliance engineering (Secure)](https://deependra.in/services/secure) - Author: [Deependra Vishwakarma](https://deependra.in/about), senior software engineer in Mumbai ## In short A security audit and web application penetration test checks your application and cloud infrastructure the way an attacker would, against the OWASP Top 10 and beyond, and ends with a ranked fix list and a retest. It is for SaaS, fintech and health teams facing a security questionnaire, a launch or a SOC 2 or ISO 27001 audit. ## Key facts - Engagement: fixed-price - Price: Fixed price per scope - Timeline: Agreed per project after scoping - First step: **Scope.** Agree targets, accounts, time windows and what's out of bounds, in writing. - Secure line: A small first step - Works with: Burp Suite, OWASP ZAP, Nmap, sqlmap, Semgrep, Trivy, Wazuh - Based in: Mumbai, India ยท UTC+5:30. I plan my working day around my clients' hours. The overlap with your timezone is shown on the [contact page](https://deependra.in/contact). ## What is a web application security audit? A web application security audit and penetration test is manual and automated testing of a web application and its cloud infrastructure, carried out the way an attacker would approach them, within a scope and rules of engagement agreed in writing. It ends with findings rated by severity, each with evidence and a fix, a retest after your fixes, and a summary you can share. It is for SaaS companies facing their first enterprise security questionnaire, fintech and health products handling sensitive data, and teams preparing for SOC 2 or ISO 27001. I completed the Google Cybersecurity Specialization. The testing method follows the OWASP Web Security Testing Guide, and findings are mapped to the OWASP Top 10:2025 and the Application Security Verification Standard where they apply. ## Who it is for, and who it is not ### Who this is for - SaaS companies facing their first enterprise security questionnaire - Fintech and health products handling sensitive personal data - Teams preparing for SOC 2 or ISO 27001 who want the technical gaps found first ### Who this is not for - Formal certification audits: SOC 2 and ISO 27001 need an accredited auditor, and I help you get ready for one ## What you get 1. A scoped test plan agreed in writing, with rules of engagement 2. Findings rated by severity, each with proof of concept and a fix 3. An infrastructure review: IAM, network rules, TLS, headers and secrets 4. A retest after your fixes, confirming what's closed 5. An executive summary for customers and investors ## Security audit, penetration test or vulnerability scan? A vulnerability scan is automated checking for known issues; it gives breadth and nothing more. A penetration test adds manual work: chaining issues together and testing access control and business logic the way a person would. A security audit, as I run it, is the scoped engagement around both: automated scanning for breadth, the manual testing, an infrastructure review, a ranked report and a retest. ## Scope and rules of engagement Before any testing we agree in writing: the targets (domains, APIs, mobile back ends, cloud accounts), the test accounts for each role, the time windows, the source addresses I'll test from, what is out of bounds, and who to call if testing finds something serious. Testing runs against staging where possible. Where it must touch production, limits are agreed in advance and destructive tests are never run there. ## What is tested Automated scanning gives breadth: known vulnerabilities in dependencies and containers, exposed services, missing headers and weak TLS. Manual testing goes where the real risks usually hide. Authentication and session handling. Authorization, above all whether one user can read or change another user's data by changing an identifier; broken access control is the first entry in the OWASP Top 10:2025. Injection of every kind, server-side request forgery, file uploads, business-logic abuse such as skipping a payment step, and secrets in code, images or front-end bundles. The infrastructure review covers IAM roles and keys, network rules, storage permissions, TLS, security headers and how secrets are stored and rotated. ## What the report contains, and what it is not Each finding has a title, a severity, the affected component, the evidence, the steps to reproduce, the impact in plain words and a specific fix. Severity uses the CVSS scale for the technical score, adjusted for your context. An executive summary sits at the front for customers and investors. A walkthrough of [what a penetration test report contains](https://deependra.in/writing/what-a-penetration-test-report-contains) shows the format with a fictional finding. It is not a certification. SOC 2 and ISO 27001 need an accredited auditor; I help you get ready for one. It is also not a compliance opinion: I test and document technical measures, and your counsel decides which obligations apply. ## How the engagement runs 1. **Scope.** Agree targets, accounts, time windows and what's out of bounds, in writing. 2. **Test.** Automated scanning for breadth, then manual testing where the real risks usually hide: access control and business logic. 3. **Report.** Findings with severity, evidence and fixes, walked through with your team. 4. **Retest.** After your fixes, I confirm what's closed and update the report. ## Technologies I use for this Burp Suite, OWASP ZAP, Nmap, sqlmap, Semgrep, Trivy, Wazuh ## How this works in your market ### How this works in Saudi Arabia For teams in [Saudi Arabia](https://deependra.in/markets/saudi-arabia), platforms processing personal data of people in the Kingdom work under the Personal Data Protection Law, supervised by the Saudi Data and AI Authority. The scoping conversation covers where the systems and the test data are hosted, so testing doesn't create a transfer outside the Kingdom that your design avoids. The schedule follows your Sunday-to-Thursday week. Confirm the legal position with your counsel. [Saudi Arabia page](https://deependra.in/markets/saudi-arabia) ### How this works in the United Kingdom For [UK](https://deependra.in/markets/united-kingdom) teams, UK GDPR expects security appropriate to the risk, and a penetration test with a retest is one of the clearer ways to show you've checked. Test accounts use synthetic data wherever possible, and where testing touches personal data the engagement includes a data processing agreement. Your morning falls in my afternoon, so the testing window and any urgent call sit in your working day. [United Kingdom page](https://deependra.in/markets/united-kingdom) ## Case studies behind this service - [Vayudoot Aviations](https://deependra.in/work/vayudoot-aviations-platform): Education platform. - [Immunomate](https://deependra.in/work/immunomate-telemedicine): Telemedicine platform. 500+ registered users. ## Questions about Security audit and penetration test ### Will testing disrupt production? Testing runs against staging where possible. Where it must touch production, we agree time windows and limits in advance, and destructive tests are never run there. ### What does a web application audit cover? Authentication, session handling and authorization; injection of every kind; server-side request forgery; file handling; secrets; business-logic abuse; and the server and cloud configuration around the app. ### Do you offer ongoing monitoring? Yes. I can set up intrusion detection and log alerting, and review them on a monthly retainer. ### How is severity decided? CVSS gives the technical score, from low to critical. I adjust it for your context, what data is exposed, who can reach it and how hard it is to exploit, and the report explains each rating. ### Can we share the report with customers? Share the executive summary and the retest result. The full report contains working attack steps, so it stays with your team and the people you name. ### Do you test APIs and mobile back ends? Yes. The API behind a mobile app is tested the same way as a web application, with test accounts for each role. ### What happens if you find something critical mid-test? I stop and tell the contact named in the rules of engagement the same day, with enough detail to act. It doesn't wait for the report. ### How much does a penetration test cost? I quote a fixed price per scope, after a scoping conversation. What moves the price is what is in scope: how many applications, APIs and cloud accounts are tested and how many user roles need test accounts. The retest of every finding is part of the audit, not an extra. ### What is the difference between a security audit and a penetration test? A penetration test is the manual part: chaining issues together and testing access control and business logic the way a person would. The security audit is the scoped engagement around it, with automated scanning for breadth, an infrastructure review, a ranked report and a retest. A vulnerability scan on its own is automated and finds known issues only. ### What do I get at the end of a penetration test? Findings rated by severity, each with evidence, the steps to reproduce and a fix; an infrastructure review; a retest after your fixes; and an executive summary you can share. [What a penetration test report contains](https://deependra.in/writing/what-a-penetration-test-report-contains) walks through the format with a fictional finding. ## Related services - [Architecture review and due diligence](https://deependra.in/services/lead/architecture-review) (Technical review): An independent, written view of a system: what's solid, what's risky, and what it will cost to fix. - [Accessibility audit and remediation](https://deependra.in/services/secure/accessibility-remediation) (Security and compliance engineering): WCAG 2.2 AA audits and the fixes in your code, for teams under the European Accessibility Act or asked for a conformance report. ## Sources 1. [OWASP Top 10](https://owasp.org/www-project-top-ten/) 2. [OWASP Web Security Testing Guide](https://owasp.org/www-project-web-security-testing-guide/) 3. [OWASP Top 10:2025](https://owasp.org/Top10/2025/) 4. [OWASP Application Security Verification Standard](https://owasp.org/www-project-application-security-verification-standard/) 5. [FIRST: CVSS v4.0 specification](https://www.first.org/cvss/v4.0/specification-document) 6. [NIST SP 800-115, Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final) ## Related writing - [What a penetration test report contains](https://deependra.in/writing/what-a-penetration-test-report-contains) (2 November 2026): The sections of a web application pentest report, what each one is for, and a fictional sample finding written the way I write real ones. - [Hardening an AI-built app: the 12-point checklist](https://deependra.in/writing/hardening-an-ai-built-app-checklist) (2 November 2026): The twelve checks I run first on an app built quickly with AI coding tools, in the order that finds the most serious problems soonest. ## Where this work happens - [Saudi Arabia](https://deependra.in/markets/saudi-arabia) (Riyadh): A software engineer for Saudi teams, working remotely from Mumbai on your Sunday-to-Thursday week, with four of your five working days overlapping fully with mine. It is for transformation programs and product teams that need data kept in the right place under the Personal Data Protection Law. - [United Kingdom](https://deependra.in/markets/united-kingdom) (London): A freelance senior software engineer for UK teams, working remotely from Mumbai with your morning in my afternoon and the UK GDPR transfer terms written into the contract. It is for scale-ups and agencies that want a senior engineer for platforms, performance and security, with most of the working morning in common. ## Teams that start here - [New York, US](https://deependra.in/markets/united-states/new-york) - [Boston, US](https://deependra.in/markets/united-states/boston) - [Edinburgh, UK](https://deependra.in/markets/united-kingdom/edinburgh) - [Munich, EU](https://deependra.in/markets/europe/munich) - [Paris, EU](https://deependra.in/markets/europe/paris) - [Dubai, UAE](https://deependra.in/markets/uae/dubai) - [Abu Dhabi, UAE](https://deependra.in/markets/uae/abu-dhabi) - [Riyadh, KSA](https://deependra.in/markets/saudi-arabia/riyadh) ## Start Scope a security audit: https://deependra.in/contact --- Cite as: Deependra Vishwakarma, "Security audit and penetration test", https://deependra.in/services/secure/security-audit (last updated 2026-11-02). This is the Markdown version of https://deependra.in/services/secure/security-audit; the page is the canonical source. Start a project: https://deependra.in/contact