Know what attackers can actually exploit.
FLODISQ provides modern penetration testing for applications, APIs and internet-facing systems. We actively test how your environment can be attacked, validate which weaknesses can actually be exploited and translate the results into clear remediation actions. AI and automation improve speed, coverage and repeatability, while FLODISQ remains responsible for scope, oversight, interpretation and follow-up.
Scoped carefully. Tested safely. Explained clearly.
A scan identifies possibilities. A penetration test shows what is real.
Security teams already have plenty of alerts. The difficult part is knowing which weaknesses can genuinely be used against the organisation, what the impact could be and what should be fixed first.
Our testing service goes beyond automated vulnerability detection. FLODISQ actively explores the agreed environment, applies relevant real-world attack techniques and validates potential findings. We oversee the complete engagement and help turn the results into practical decisions.
The outcome is a prioritised view of exploitable risk, supported by technical evidence and remediation guidance your teams can use.
What we can test
Web applications
Customer portals, SaaS platforms and business-critical web applications.
APIs
REST APIs, integrations, application back ends and exposed API functionality.
Internet-facing infrastructure
External systems and services that may be reachable by an attacker.
Authenticated functionality
Protected functionality behind a login, tested with agreed test accounts and permissions.
Black-box testing
We start with the same knowledge as an outsider: none. This shows what is visible and usable from the internet.
Testing with inside knowledge
Where useful, we use documentation, API descriptions or code to dig deeper and find more within the same time.
Final scope, access method and safety controls are agreed before testing starts.
Each security check has its own blind spot
Reviewing code, scanning for known weaknesses and penetration testing are complementary. Each happens at a different moment and gives a different kind of certainty. Think of securing a building: you can study the drawings, inspect the construction or actually try to get in.
| Approach | Comparable to | What it tells you |
|---|---|---|
| Static code analysis | Checking the architect’s drawings | Which patterns in the code could become a risk? |
| Peer code review | A colleague inspecting each new extension | Does a specific change introduce a flaw? |
| Vulnerability scanning | Walking around the building checking for open windows | Where are known weaknesses likely to be present? |
| Configuration and compliance checks | Comparing the building against the regulations | Are agreed standards and settings applied? |
| FLODISQ Penetration Testing | Trying to get inside, the way a burglar would | Which weaknesses can really be used in the live environment, and what would the consequences be? |
Analysis tells you where something might be wrong. A penetration test shows what an attacker can really do with it.
We look at your live applications and systems the way an adversary would: searching for entry points, combining weaknesses and confirming impact with evidence. That gives you a solid basis for risk decisions, remediation planning and assurance towards customers and auditors.
From first conversation to proven improvement
- 01
Scope
Together we agree what is tested, which accounts and environments are available, and which boundaries apply. You know in advance exactly what will happen and when.
- 02
Investigate
We chart the functionality, entry points and connections within scope, and look for weaknesses and combinations of weaknesses an adversary could use.
- 03
Confirm
Promising leads are worked out until it is clear whether they really pose a risk. What cannot be demonstrated does not end up as a high-priority finding.
- 04
Resolve
We walk your teams through the results, agree priorities and check after the fixes have gone live whether the problems have indeed been solved.
Modern testing. Expert judgement.
We use AI and automation where they improve speed, coverage and repeatability. Technology supports the assessment, but FLODISQ determines the right scope, understands your business context and helps decide what deserves attention first.
FLODISQ delivers and oversees the complete testing service, from scope and controlled execution to interpretation, remediation and retesting.
- We define a proportionate scope and testing approach with you.
- We establish access, exclusions and safety boundaries before the test.
- We monitor the engagement and review the quality and relevance of the output.
- We explain the results to management, security and technical teams.
- We help convert findings into an achievable improvement plan.
- We coordinate retesting so that remediation can be demonstrated.
Choose the testing model that fits your risk
Focused Security Test
A targeted test of a defined application, API or internet-facing environment. Suitable for a new service, an important release, periodic assurance or a specific customer requirement.
Request a scoped test →Deep Application Pentest
A broader engagement for critical or complex applications, with additional context, wider coverage and closer specialist involvement. Suitable for sensitive data, complex authorisation models, multiple roles or high business impact.
Discuss a deep pentest →Continuous Security Testing
Repeatable testing after relevant changes or on an agreed cadence. Suitable for SaaS platforms, DevOps teams and digital services that change too frequently for an annual point-in-time test.
Explore continuous testing →Penetration testing with clear starting points
Choose a scope that matches the complexity and risk of your application. We confirm the final scope after a short call covering applications, APIs, user roles, authentication, business logic and testing depth.
Focused Pentest
For a defined, relatively straightforward application and its primary APIs.
- 1 web application or service
- Primary APIs included
- Typically 1–2 authenticated user roles
- Straightforward authentication and authorisation model
- Limited to moderate business logic
- Limited number of external integrations
- Defined internet-facing scope
- Standard testing depth
- Management summary + technical findings
- One specialist debrief
- One retest of remediated findings
Advanced Pentest
For business-critical applications with more roles, workflows or API complexity.
- 1 application or tightly coupled application/API set
- Typically 3–6 authenticated user roles
- Broader API surface or multiple API groups
- More complex authorisation boundaries
- Material business logic and workflows
- Several external integrations
- Authenticated and unauthenticated attack paths
- Deeper testing of privilege, workflow and access-control scenarios
- Management + technical debrief
- One retest of remediated findings
Complex Pentest
For large applications, platforms and architectures with a substantial attack surface.
- Large application or application landscape
- Typically 7+ roles or multiple permission models
- Many endpoints, services or microservices
- Complex business logic and cross-service workflows
- Multiple trust boundaries and integrations
- Several authentication mechanisms or identity flows
- Large or distributed API surface
- Deeper attack-path testing and specialist oversight
- Phased execution where useful
- Management + technical debrief
- One retest of remediated findings
Enterprise Pentest
For interconnected systems where a fixed standard package would create artificial scope limits.
- Multiple applications, platforms or business services
- Multiple teams, owners or environments
- Interconnected trust relationships and identity flows
- Large numbers of APIs, endpoints or subdomains
- Complex operational or regulatory requirements
- Phased delivery and governance
- Consolidated management reporting
- Custom retesting and remediation support
For applications that change too frequently for an annual point-in-time test. Continuous testing is scoped separately because cost depends on release frequency and the amount of security-relevant change.
Discuss continuous testing- Initial onboarding and baseline scope
- Testing after agreed releases or on an agreed cadence
- Focused testing of security-relevant changes
- Periodic FLODISQ oversight and service review
- Consolidated reporting and remediation follow-up
- Usage component confirmed from the agreed testing model
All prices are indicative, exclude VAT and assume a test-ready environment, agreed test accounts and no material scope changes. FLODISQ confirms the final fee before testing starts.
How we determine the right package
The package is determined by complexity, not simply by lines of code or the number of pages in an application. The following criteria drive scope and price.
| Criterion | Focused | Advanced | Complex | Enterprise |
|---|---|---|---|---|
| Applications | 1 | 1 / tightly coupled set | Large app / landscape | Multiple systems |
| User roles | 1–2 | 3–6 | 7+ / multiple models | Custom |
| Business logic | Low–moderate | Moderate–high | High / complex | Cross-system |
| API surface | Primary APIs | Broader | Large / microservices | Multi-platform |
| Testing depth | Standard | Deeper | Deep / phased | Custom |
| Price | From €5,950 | From €10,950 | From €19,950 | On request |
Applications
One application is normally Focused or Advanced. Multiple independently deployed applications generally move to Complex or Enterprise.
User roles
1–2 roles usually fits Focused; 3–6 points to Advanced; 7+ or several permission models usually requires Complex scoping.
APIs and endpoints
A primary API can sit inside Focused. Multiple API groups, numerous endpoints or microservices increase testing effort and usually move the scope upward.
Authentication
Standard login is simpler. SSO, MFA, federation, delegated access, multiple identity providers or complicated recovery flows increase scope.
Business logic
Simple CRUD-style workflows are lower effort. Payments, approvals, entitlements, multi-step transactions or high-value actions require deeper testing.
Integrations
Each external integration or trust boundary can create additional attack paths and increases scope.
Testing depth
Standard coverage fits Focused. Complex workflows, unusual attack paths or deeper assurance requirements move toward Advanced or Complex.
Environment readiness
Pricing assumes working test accounts, reachable targets and stable scope. Material setup work, blocked access or late scope changes can affect price.
What is included in every pentest
- Scoping and rules of engagement
- Controlled penetration testing
- Validation of relevant findings
- Prioritised technical findings and remediation guidance
- Executive/management overview
- FLODISQ specialist review and debrief
- One standard retest, unless explicitly scoped otherwise
What can change the price
- Additional applications, domains or API groups added after scoping
- Additional authenticated roles or permission models
- Unplanned setup or troubleshooting needed to make the environment testable
- Significant production restrictions that require alternative testing approaches
- Additional manual specialist work beyond the agreed testing depth
- Expedited delivery, additional retest cycles or extensive remediation workshops
- Separate regulatory, customer-specific or board reporting requirements
When to use FLODISQ Security Testing
Before go-live
Test a new customer portal, platform or API before it becomes externally available.
After a significant release
Check whether new functionality, integrations or changes introduced exploitable weaknesses.
For customer or audit assurance
Provide evidence that relevant security risks have been tested and remediation is being managed.
For critical digital services
Test systems where compromise could affect customers, sensitive information or operational continuity.
During supplier or acquisition review
Gain additional assurance over an application or exposed environment during due diligence.
As part of secure development
Add repeatable offensive testing to an existing development and release process.
What you receive
Executive overview
A concise explanation of the scope, overall risk picture and the issues that require management attention.
Verified findings
Prioritised vulnerabilities that have been validated rather than merely inferred by a scanner.
Technical evidence
Relevant attack details, example request and response information, proof of exploitability and references where applicable.
Remediation guidance
Clear, developer-ready advice to help address the underlying weakness.
Specialist debrief
A discussion with FLODISQ to explain significance, priorities, dependencies and sensible next steps.
Retesting
Confirmation testing after remediation, so that closed findings can be supported by evidence.
More than a scanner. More repeatable than a one-off pentest.
| Capability | Vulnerability scan | Traditional pentest | FLODISQ Security Testing |
|---|---|---|---|
| Automated discovery | Yes | Varies | Yes |
| Attempts exploitation | Usually limited | Yes | Yes |
| Validates findings | Usually limited | Yes | Yes |
| Fast, repeatable execution | Yes | More difficult | Yes |
| Continuous testing option | Yes | Usually difficult | Yes |
| Human security interpretation | Usually limited | Yes | Yes |
Comparison is indicative. Coverage and depth depend on the agreed scope, access and test design.
Controlled testing, with clear boundaries
A good test is thorough without putting your operations at risk. That is why we record the rules of play beforehand: which systems and accounts are in scope, what is and is not allowed, the testing windows, who to call in case of doubt and any restrictions on production systems.
We avoid actions that could damage data or availability. If a step could have consequences beyond the agreed boundaries, we consult you before continuing. Like any test, a pentest offers no guarantee that every vulnerability will be found. Social engineering and physical access fall outside this service unless explicitly agreed.
Frequently asked questions
How is this different from a vulnerability scan?
A scan produces a list of things that might be wrong. We go further: we try to use weaknesses the way an adversary would, and only report something as a serious finding once its impact has been demonstrated.
What role do AI and automation play?
They help us cover more ground in less time and make tests easy to repeat. Decisions about scope, interpretation and priorities are always made by FLODISQ specialists.
Do you also test the part behind the login?
Yes, if we agree to. With test accounts for different roles, we check whether users can only see and do what they are entitled to.
Are APIs included?
They can be. Interfaces and back-end services are often where the most interesting weaknesses are. Documentation such as an API specification helps us test more completely.
What happens after we have fixed the findings?
We test the resolved findings again, so you have evidence that the fixes work. One retest is included as standard.
Does this cover every type of security test?
No. The focus is on applications, APIs and systems reachable from the internet. Phishing, phone-based deception and physical access are covered by Social Engineering. See also our full range of Security Testing services.
Want to know what an attacker could actually exploit?
Tell us what you want to test. We will help you define the right scope, access and testing approach, then turn the results into clear action.