Service — Security audit
Web security audit for your website or application
Attackers now automate the search for weaknesses with AI. The audit applies the same techniques to your application, methodically and within a written framework, to tell you precisely where it is exposed and in which order to fix it.
Situations that call for an audit
Before launching a new application, after the departure of the provider who built it, at the request of a major customer who expects safeguards, or simply because a recent incident has raised doubts: an outside, well-equipped review measures the real risk instead of guessing it. The audit covers applications built by Vertigo Dev as well as tools designed by a third party.
What the audit covers
- a review of the source code and configuration, based on the OWASP guidelines;
- an analysis of dependencies and of the publicly known vulnerabilities affecting them;
- access control checks: authentication, sessions, role-based permissions, exposed identifiers;
- a search for injections, data leaks and server misconfigurations;
- penetration tests with written authorisation from the owner, limited to the agreed scope and period;
- a report ranked by risk level, with concrete and realistic recommendations.
AI-assisted attacks, guided by experience
In a few hours, AI explores combinations a human would take days to try: request variations, page sequences, forgotten parameters. It also produces many false alarms. My role is to sort them, reproduce each finding by hand and assess its real impact on your business, so that the report only contains verified points.
Penetration tests are only carried out with written authorisation from the owner of the system, stating the scope, the dates, the people to notify and the conditions for stopping. Without this signed document, only the code and configuration review is possible.
How an audit engagement unfolds
Signed audit agreement
Scope, target environments, schedule and emergency contacts are set in writing before any action.
Tool-based, then manual analysis
Automated tools sweep the application, then every promising lead is investigated by hand.
Commented debrief
A meeting presents the findings to the technical teams and to management, in language suited to each.
Re-test
Once the fixes are in place, the critical points are tested again to confirm they are resolved.
Fix, then stay alert
An audit is a snapshot taken at a given moment. Maintenance and security updates extend the effort by applying fixes as they are released. When the weaknesses stem from the very design of the tool, developing a custom web application can prove safer than a series of patches. To learn more about who runs the audit, read about Vertigo Dev.
Take stock of your application’s exposure
Give the address of the application, the technology used if you know it and the reason for your request: I will propose an audit scope and a template for the written authorisation.