WSTG-Based Vulnerability Assessment

It is a web application security test that follows the OWASP Web Security Testing Guide, working through its categories systematically to identify and manually validate vulnerabilities, rather than relying on an automated scan alone.

A vulnerability assessment aims for breadth: systematically finding and validating as many real weaknesses as possible across the WSTG categories. A penetration test goes for depth: chaining findings and pivoting to demonstrate how far an attacker could get toward a specific goal. This service is the assessment; if you need the attack narrative and exploitation chaining as well, we offer a combined assessment-and-penetration-test engagement.

A scanner is good at breadth on known signatures but blind to authorization flaws, business-logic abuse, and chained issues, and it produces false positives. We use tooling for coverage, then test manually for the classes a scanner cannot judge, and we verify every finding by hand before reporting it.

The application URL and environment, and test accounts for each role (at least two users per role, so we can test cross-user access). Access to documentation or source enables a deeper grey- or white-box test. We agree the scope and any areas to avoid before we begin.

We prefer a staging environment that mirrors production. When testing must run against production, we agree limits in advance — no destructive actions, care with anything that writes or bulk-processes data, and a contact on your side to pause immediately if something looks wrong.

Each finding gets a CVSS score for a common baseline, adjusted by the real business impact in your context — what it exposes, how easily it is reached, and what an attacker gains. That is why two issues with the same CVSS can be prioritized differently.

Yes. After you remediate, we re-test the reported findings to confirm each fix holds and did not introduce a new issue, and update their status in the report.

The WSTG spans information gathering, configuration and deployment, identity and authentication, authorization, session management, input validation (injection and cross-site scripting), error handling, weak cryptography, business logic, and client-side testing — the full surface of a modern web application, which maps onto the OWASP Top 10 risk categories.

It depends on the application's size and complexity and the number of roles; a comprehensive assessment typically runs about two to four weeks. We give a firm estimate after scoping.