Skip to main content
OneX Security⁠
Get in touch
OneX Security⁠

Select language

Discuss an assessment

Penetration testing & security assessment: Understand the risk. Prioritize the response.

Web applications, mobile apps, cloud environments and security advisory.

Assess exploitable weaknesses in the context of your business. Turn technical findings into clear remediation priorities and a defined path to verification.

Discuss your assessmentExplore our services

A clearly defined engagement

  1. 1Written authorization before any testingSee step 3
  2. 2Scope, methods and testing windows agreed in advanceSee step 3
  3. 3Confidentiality and data handling defined before accessSee step 2
  4. 4Remediation verified through agreed retestingSee step 6

Evidence for your next security decision.

An assessment should give both technical teams and decision-makers a clear basis for action.

  1. Understand the exposure

    Document affected assets, supporting evidence and business impact so each finding can be assessed in context.

  2. Prioritize remediation

    Distinguish urgent issues from longer-term improvements, with practical recommendations for the teams responsible.

  3. Verify the response

    Record remediation outcomes through agreed retesting, including any remaining risk and follow-up actions.

Choose the assessment your decision requires.

Start with the systems you need to protect. Review the scope, approach and deliverables before discussing an engagement.

Web Application Penetration Testing

Validate exploitable weaknesses across web applications, APIs and business-critical workflows.

Business concern

Unverified application weaknesses can expose data, accounts and critical transactions.

View service details

Assessment approach

Manual testing supported by tools, with a focus on access control, application logic and relevant OWASP risks.

Typical scope

  • Corporate websites, web applications, and admin panels
  • REST, GraphQL, and other APIs
  • Authentication flows such as login, sign-up, and password reset

What you receive

Vulnerability report · Risk ratings · Remediation guidance · Retesting within agreed scope

Discuss this scope
Compare all services
Compare all services
ServiceBusiness concernAssessment approachWhat you receive
Web Application Penetration TestingUnverified application weaknesses can expose data, accounts and critical transactions.Manual testing supported by tools, with a focus on access control, application logic and relevant OWASP risks.Vulnerability report · Risk ratings · Remediation guidance · Retesting within agreed scope
Mobile Application Security TestingClient-side weaknesses and unsafe API interactions can expose sensitive information or enable misuse.Static and dynamic analysis of mobile applications, combined with authorized testing of backend interfaces.Test report · Hardening recommendations · Support for app store compliance
Cloud Security AssessmentExcessive permissions, exposed resources and gaps in monitoring can increase cloud risk.Read-only configuration review, identity and permission analysis, and assessment of agreed external exposure.Risk list · Baseline score · Remediation roadmap
Cybersecurity ConsultingSecurity investment and compliance work need priorities, ownership and a practical implementation plan.Current-state review, gap analysis, phased planning and advisory support tailored to your organization.Tailored security plan · Long-term advisory support

Authorization sets the boundary.

From initial scoping to verified remediation

A structured engagement with defined responsibilities, documented findings and an agreed path to follow-up.

  1. 1No testing before authorization

    Scope the requirement

    Establish the business context, proposed assets, assessment objectives and delivery expectations.

  2. 2No testing before authorization

    Agree confidentiality

    Define confidentiality and data handling before exchanging credentials, architecture or other sensitive material.

  3. 3Authorized

    Confirm authorization

    Verify authority and third-party permissions. Agree assets, methods, exclusions, testing windows and stop conditions in writing.

    The letter states

    • Scope
    • Testing window
    • Methods
  4. 4Authorized test window

    Conduct the assessment

    Perform agreed activities within the authorized scope, coordinate operational concerns and escalate significant findings.

  5. 5

    Deliver the findings

    Document evidence, impact and remediation priorities, with recommendations appropriate to the affected environment.

  6. 6Authorized test window

    Verify remediation

    Retest agreed findings after remediation and document their status, residual risk and any further action required.

Testing begins only after authorization is verified and the agreed conditions are in place. Scope changes or withdrawal of authorization require the affected work to pause.

Scope, responsibilities and follow-up arrangements are confirmed before work begins.

Clear responsibilities at every stage.

Scanning and vulnerability verification start only after valid written authorization.Engagement commitments 1 Work stays within the scope agreed by both parties.Engagement commitments 2 Confidentiality and data handling are agreed before sensitive information is exchanged.Engagement commitments 3 Deliverables focus on risk, remediation and verification.Engagement commitments 4

Engagement commitments

  1. Authorization first

    Targets, methods, testing windows and exclusions are agreed in writing before work begins.

  2. Defined scope

    Required cloud, hosting and other third-party permissions are checked first. Scope changes require fresh confirmation.

  3. Confidential handling

    The agreement defines access permissions, report recipients, retention periods and deletion arrangements.

  4. Actionable findings

    Reports explain impact and remediation. Retesting and follow-up are arranged under the project agreement.

Start with a clear assessment brief.

Share your organization, contact details and area of interest. We will use your request to discuss scope and next steps. No testing begins through this form.

Prepare your enquiry

  1. Describe your organization and select the relevant services.
  2. Review the authorization notice and confirm each acknowledgement.
  3. Review the prepared email, then send it from your email service.

Assessment enquiry

Services needed RequiredSelect all that apply
Security testing authorization and responsibility

Notice version: 2026-11-10.1

This form requests contact and a discussion of your needs. It does not authorize scanning or penetration testing. Testing starts only after written agreement and any required third-party permissions.

Before you confirm

Testing risks and preparation

Even agreed testing can trigger alerts, reduced performance, service interruption or unexpected data changes. Clients should prepare backups and recovery, coordinate with relevant parties and supply accurate asset and authorization information. If you do not accept testing risks, you may discuss advisory needs without requesting tests.

Responsibilities and limits of liability

Clients are responsible for the accuracy and lawfulness of the authority, asset ownership and information they provide. Losses or claims arising from false authorization, missing third-party permission or a client breach are addressed under applicable law and the agreement. Risk allocation, recoverable losses and liability limits must be separately agreed in the formal contract, to the extent permitted by law. This notice does not exclude liability that cannot lawfully be excluded or permit unlawful, unauthorized or out-of-scope activity. Testing cannot guarantee discovery of every vulnerability or absolute security.

Read the full authorization notice

  1. 1.Authority and third-party permission

    You must own the proposed systems or hold express authority from their owner. Employment alone does not confer authority to approve testing. Cloud platforms, hosting providers, suppliers and other third-party assets require the relevant permissions. We may request evidence and decline or suspend services if authority cannot be verified.

  2. 2.Written testing scope

    Before testing, authorized representatives of both parties must sign a service agreement and testing authorization covering domains, IPs, applications and environments, permitted methods and exclusions, testing windows, source addresses, third-party permissions, emergency contacts and stop conditions. Unlisted assets and activities are excluded. Refusal, withdrawal or changes to authorization require the affected testing to pause pending written confirmation.

  3. 3.Testing risks and preparation

    Even agreed testing can trigger alerts, reduced performance, service interruption or unexpected data changes. Clients should prepare backups and recovery, coordinate with relevant parties and supply accurate asset and authorization information. If you do not accept testing risks, you may discuss advisory needs without requesting tests.

  4. 4.Responsibilities and limits of liability

    Clients are responsible for the accuracy and lawfulness of the authority, asset ownership and information they provide. Losses or claims arising from false authorization, missing third-party permission or a client breach are addressed under applicable law and the agreement. Risk allocation, recoverable losses and liability limits must be separately agreed in the formal contract, to the extent permitted by law. This notice does not exclude liability that cannot lawfully be excluded or permit unlawful, unauthorized or out-of-scope activity. Testing cannot guarantee discovery of every vulnerability or absolute security.

  5. 5.Information use and confidentiality

    Company, contact person and contact details are used to discuss this request and retain request confirmation records. A configured external form provider also receives the submission. Do not submit passwords, keys or vulnerability details. Before testing, both parties must separately agree confidentiality, data access, retention, deletion and incident handling requirements.

Caution Include only the information needed for initial contact. Exchange credentials, sensitive architecture and vulnerability details through an agreed channel after confidentiality arrangements are in place.

Review and send your enquiry

Your request includes the selected services and acknowledgement record. Sending an enquiry does not authorize testing.

You send the request from your email app. We use your information to discuss this enquiry and retain its confirmation records.

How the engagement proceeds

  1. 1

    Contact and verification

    Discuss your needs and verify the representative’s authority, asset ownership and required third-party permissions.

  2. 2

    Written agreement

    Sign confidentiality, service and testing authorization documents covering scope, timing, risks, responsibilities and stop conditions.

  3. 3

    Authorized testing

    Test only after written authorization takes effect, within its scope, then provide findings and recommendations.

Contact us directly

Email
service@onexasset.comSend email