Penetration Test Servicesby Excession Labs Request a test

Penetration testing by Excession Labs

Penetration tests that prove every finding

We test web applications, APIs and multi-tenant SaaS platforms. Every finding in our report shows the request and response that prove it, what an attacker gains, and the fix.

Request a testSee the sample report

Testing starts only after a written scope and written authorization from the system owner.

Demonstration
F-01 · Harbor Notes (demo app)Critical

Any signed-in user can export another workspace's notes

Asset
api.harbor-notes.example
Evidence
Observed, read back from tenant B
Status
Open
GET /v1/workspaces/ws_test_B/export
Authorization: Bearer <tenant A member>
→ 200 OK · 41 notes · owner: ws_test_B
# control: nonexistent workspace
GET /v1/workspaces/ws_test_ZZ/export
→ 404 Not Found

Fix: check in the export handler that the caller belongs to the workspace. A check in the UI does not protect the API.

Each finding also has reproduction steps and a retest resultOpen the sample report

What we test#

Applications your customers sign in to. Most of our time goes into access control: whether one user can read or change another user's data, and what the API accepts without checking.

Web applications

Access control, sessions and business logic#

Roles, sharing, invitations, uploads, payments and admin paths. Web app testing

APIs

REST and GraphQL, documented or not#

Object-level authorization, mass assignment, rate limits and data exposure. API testing

Multi-tenant SaaS

One customer must never reach another#

Two test tenants, every object type, every export and search path. SaaS testing

No-code and AI-built apps

Bubble, Supabase, Firebase and fast-built apps#

Privacy rules, row-level security, exposed keys and workflow endpoints. Platform testing

Before launch

Test the release before customers do#

Find the exploitable issues while fixing them is still cheap. Pre-launch testing

For a customer review

Evidence for an enterprise deal#

A report your buyer's security team can read, with fixes verified. Customer security reviews

Building with LLMs or agents? Those need a different test: AI application security assessments.

We report a finding only when we can show its effect#

If an API answers "200 OK" to a request that should fail, we still have to prove that something happened. We read the changed record back through a second account, show a cross-site attack working in a real browser, or show the exposed data from a test-owned record.

Each attack also runs with controls: a nonexistent ID, the wrong record type, an unsigned token and an anonymous caller. If a control shows the first result was misleading, the issue does not go in the report as confirmed.

Read our methodology

  1. ObserveTenant A's token requests tenant B's export. The API returns 200 and 41 notes.
  2. ControlSame request for a workspace that does not exist returns 404, so the 200 is not a generic response.
  3. Read backTenant B's own session lists the same 41 note IDs. The data really belongs to tenant B.
  4. BoundOnly test-owned workspaces were used. No real customer data was read.
  5. VerdictConfirmed. Rated Critical, with a fix and a retest step. (Demonstration example.)

What every test includes#

  • A written scope and rules of engagement that you approve
  • An executive summary with the few actions that matter most
  • For each finding: description, impact, verified results, reproduction steps and a fix
  • Controls that held, so fixes do not break working protections
  • A remediation plan and a list of limitations and open questions
  • Evidence files and reproduction scripts, in HTML, PDF and Markdown
  • A retest of fixed findings, agreed in the scope
Open the sample report

How a test runs#

  1. Short call

    What triggered the test, who will read the report, and your deadline.

  2. Written scope and authorization

    Hosts, roles, test windows, off-limits actions and contacts. The system owner signs.

  3. Testing

    Against the agreed rules, with bounded tests and test-owned data.

  4. Report

    Every finding with evidence, reproduction and a fix.

  5. Fix and retest

    We verify your fixes and record the result.

Who does the work#

Excession Labs builds Incursion, an AI agent for authorized security testing. It splits an engagement into tasks and runs them in parallel. Each tool runs on its own, waits for approval, or is blocked, by rules we set for your scope.

Incursion runs the repetitive checks across every role and endpoint. Excession Labs agrees the scope with you, checks the evidence for each finding and writes the report.

About Excession Labs · How AI-assisted testing works

Free pilot on a small scope#

For a small number of teams with a real application and a reason to use the result, we run a free pilot. The scope is small and written down. You get every finding in that scope, with evidence and fix guidance, at no cost.

Apply for a pilotPricing and scope

Guides for planning and using a pentest#

Pentest basicsWhat is penetration testing?What a test is, what it produces and how it differs from a scan. Planning a pentestHow to prepare for a penetration testAccounts, data, environments and contacts to set up before day one. Compliance and evidenceDoes SOC 2 require a penetration test?What the criteria say, and what auditors and customers usually ask for. API testingIDOR testingHow testers prove broken object-level authorization with two accounts. SaaS testingMulti-tenant isolation testingA two-tenant test matrix for objects, search, exports and files. After the pentestHow to read a pentest reportSeverity, evidence, reproduction and how to plan the fixes.

All guides

Questions

What does a penetration test from Excession Labs cover?

Web applications, APIs (REST and GraphQL) and multi-tenant SaaS platforms. We agree the exact hosts, roles and actions in a written scope before testing. AI features such as chat assistants and agents are assessed separately through airedteamingservices.com.

How much does a penetration test cost?

We quote after a short scoping call, because the price depends on the number of applications, user roles, API endpoints and environments, and on your deadline. See pricing and scope for what changes a quote. Small teams can apply for a free pilot.

Do you test production?

We prefer a staging environment with realistic data. If production is the only option, we agree limits in writing first: no destructive actions on real data, bounded tests of email, uploads and paid third-party services, and a contact who can stop testing at any time.

Will our auditor or customer accept the report?

Nobody can promise that. What we can do is ask what the reviewer needs during scoping, and write a report that shows scope, method, evidence and fixes clearly. Check the sample report and share it with the reviewer before you buy.

Do you use AI to test?

Yes. We use Incursion, the Excession Labs testing agent, to run test tasks in parallel under tool rules we set. Excession Labs checks the evidence for each finding and writes the report. How AI-assisted testing works.

Need a pentest you can act on?

Tell us what you need tested and why. We reply to agree scope, and testing starts only after written authorization.

Request a testSee the sample report