Web Application Penetration Testing
Applications inside your ISMS scope, especially those processing customer data.
Compliance
ISO 27001 Penetration Testing
ISO 27001 expects you to find and handle technical vulnerabilities, and to test security during development. A pentest is strong evidence for both.
In plain English
What ISO 27001 expects from security testing
ISO/IEC 27001 asks you to run an information security management system: understand your risks, choose controls to treat them, and show that those controls work. Annex A lists the controls, and two of them relate directly to security testing.
Control 8.8 covers the management of technical vulnerabilities. You need a way to find out about vulnerabilities in your systems, judge how exposed you are, and act on what you find. Control 8.29 covers security testing during development and acceptance, so new and changed systems are tested before they go live.
The standard doesn’t prescribe a penetration test by name, and it leaves the frequency to your risk assessment. But a manual pentest gives your auditor concrete, dated evidence that vulnerabilities are being looked for, rated and fixed, which is exactly what these controls are about. Confirm specific expectations with your auditor.
Evidence
How our report supports it
- Evidence that technical vulnerabilities are actively identified, not just assumed absent
- Severity ratings you can feed directly into your risk assessment and treatment plan
- Remediation guidance and retest results that show vulnerabilities were handled
- A dated scope and methodology your certification auditor can review
- Findings you can track as nonconformities or improvement actions in your ISMS
Scope
Recommended scope
Every environment is different. This is where we usually start, and we'll confirm it on a scoping call.
API Penetration Testing
APIs that expose information assets covered by your ISMS.
Internal Network & Active Directory Testing
Internal networks and identity systems, where access control controls are tested in practice.
Cloud Security Testing (AWS, Azure, GCP)
Cloud environments hosting in-scope information assets.
Secure Code Review
Supports 8.29 by testing security in the development life cycle.
Timing
When to test
Test before your Stage 2 or surveillance audit, leaving time to remediate and retest.
Align the test scope with your Statement of Applicability and ISMS scope.
Build testing into your release process for major changes, not just an annual cycle.
Record findings in your risk register so the auditor sees them treated, not just reported.
FAQ
ISO 27001 testing questions
Does ISO 27001 require a penetration test?
The standard doesn't name penetration testing as mandatory. But Annex A 8.8 expects you to identify and evaluate technical vulnerabilities, and 8.29 expects security testing in development. A pentest is one of the most direct ways to evidence both, and many certification auditors expect to see one.
Which version of ISO 27001 do you map to?
ISO/IEC 27001:2022. If you are still transitioning from the 2013 version, the equivalent controls were A.12.6.1 and A.14.2.8, and we can reference both.
How often should we test?
The standard doesn't set a frequency. Annual testing plus testing after significant changes is a common, defensible approach. Your risk assessment should drive the final answer.
Does a penetration test report certify us to ISO 27001?
No. Certification decisions are made by your accredited certification body. Our penetration test report is evidence for your ISMS that the auditor can review.
Guides
How to Read a Penetration Test Report
How to read a penetration test report: what severity ratings mean, how to judge the evidence, which findings to fix first, and how the retest closes the loop.
Services for this framework
Web Application Penetration Testing
Manual testing of your web app's authentication, access control and business logic, the places scanners can't reach.
API Penetration Testing
Hands-on testing of REST, GraphQL and gRPC APIs for broken authorization, data exposure and abuse of business logic.
Internal Network & Active Directory Testing
Assumed-breach testing of your internal network and Active Directory, delivered remotely, to show how far one compromised laptop could go.
Need a pentest for an audit, a customer, or peace of mind?
Tell us what you need tested. You’ll get a fixed-fee proposal with tester-days and timeline stated, usually within a few days of the scoping call.