VALLUM PROOFaudit-ready penetration testing · retest included

Prove your security to the people who are asking.

Vallum runs fixed-price penetration tests for small and midsize businesses, then hands you the evidence an auditor, a regulator or a major customer will accept.

We test your web apps, APIs and cloud the way an attacker would, then deliver a report your team can fix from and your auditor can file — whether you're chasing SOC 2 or ISO 27001, answering a customer's security questionnaire, or simply proving to the people who trust you with their data that it's safe.

Book a 30-minute scoping call Get a fixed-price quote See a sample report →

// scope · test · prove · retest

Working with companies across the GCC, Morocco and Europe. English, French and Arabic.

1named senior tester from scope to debrief

5-7dkickoff to report, standard scope

24hto flag any critical finding

30dretest window, no extra charge

Tested against, mapped to

OWASP Top 10OWASP ASVSOWASP API Security Top 10NIST SP 800-115PTESMITRE ATT&CKCVSS v3.1ISO 27001SOC 2PCI DSS

// reports support audit evidence · always confirm requirements with your auditor

The promise

Built to hold up when someone checks your work.

Every engagement is designed to produce evidence an auditor, a regulator or a customer can rely on — not a scan dump with a logo on it.

Senior-led, start to finish

An OSCP/OSEP-certified tester scopes, runs and debriefs every engagement. No juniors swapped in after you sign, and one accountable point of contact throughout.

Fixed scope, fixed price

A written quote follows a 30-minute call. If the scope changes, you hear the price before any extra work starts.

Evidence over volume

A shorter report of findings we have exploited and can replay is worth more than a long list of scanner output. Every finding comes with proof.

Critical issues don't wait

Anything critical reaches your team within 24 hours, not weeks later in a PDF.

AI-assisted, privately run

We use AI tooling to speed up recon and report drafting, but it runs on infrastructure we own, not a third-party AI product. Nothing about your systems leaves our environment, and every exploit is still verified and run by hand.

Consulting

Four ways we test, one standard of proof.

Each engagement is scoped to what you actually run. Every one is senior-led and produces the same audit-ready evidence.

Web Application Penetration Testing

Manual testing mapped to your actual business logic, not a scanner checklist.

Modern web apps rarely break at the OWASP Top 10 alone. They break between features: a discount that stacks after a role switch, a webhook retry that skips a check, an endpoint three clicks deep that a scanner never reaches. We map the application by hand from live traffic and, where you provide it, the source, then work the gaps a checklist misses.

What's covered

Authentication, sessions and token lifecycle
Business logic abuse across multi-step flows
Client-side risk: DOM XSS, prototype pollution, third-party scripts
Content discovery: old endpoints, JS bundle analysis, forced browsing

Good fit if

You're shipping a customer-facing app and need more than an automated scan before a launch or an audit — common for SaaS, e-commerce and fintech products, but not only those.

OWASP Top 10Business logicClient-sideSource review

API Penetration Testing

REST and GraphQL, tested the way customer data actually leaks: role by role.

Most serious API breaches aren't a missing WAF rule, they're one endpoint that forgot to check who's asking. We build a route map from your OpenAPI spec and live traffic, then replay every call as each role and tenant you provide, comparing what should be refused against what the server returns.

What's covered

Object- and function-level authorization (BOLA / BFLA)
Mass assignment and excessive data exposure
Authentication: JWT handling, OAuth flows, SSO
GraphQL-specific risk: introspection, batching, depth abuse

Good fit if

Your product is API-first, or your web app is a thin client over an API that's never been tested on its own — typical for fintech, logistics and SaaS platforms with real integrations.

BOLA / BFLAOAuth & SSOGraphQLRate limiting

Roles & Access Control

Proof that no account can reach data or actions it wasn't meant to, in writing.

Whether you have customer accounts, staff accounts, or both on the same system, the costliest bug is invisible from outside: a flag trusted from the client instead of checked on the server, an invite flow that leaks across accounts, a support role that can quietly do what only an owner should. We build a role-by-role matrix for every account type you have and walk it systematically, because this class of finding ends up in a headline, not a changelog.

What's covered

Full matrix: every endpoint, every role you define
Horizontal escalation (one account reaching another's data)
Vertical escalation (a lower role reaching admin functions)
Invitation, onboarding and account-linking edge cases

Good fit if

More than one type of account, customers, staff, admins, touches the same system — true for SaaS, healthcare portals and e-commerce back offices alike, whether or not you sell to multiple companies from it.

Role matrixHorizontal escalationVertical escalationMulti-account

Cloud Configuration Review

The AWS, Azure or GCP settings that actually affect your application's blast radius.

A cloud account has thousands of settings, and most don't matter to your specific app. This isn't a generic benchmark run that hands you 200 low-severity findings to ignore. We review the configuration around the application in scope: who can assume what role, which storage is actually reachable, how secrets move between services, and what an attacker could reach from inside it if it were compromised.

What's covered

IAM roles, policies and privilege boundaries
Storage (S3 / GCS / Blob) exposure and bucket policy
Network boundaries: security groups, peering, public endpoints
Secrets management and service-to-service auth

Good fit if

You want the review scoped to the application being tested, not a 40-page account-wide audit — relevant anywhere from a fintech API to a logistics dashboard.

IAMStorage exposureNetwork boundariesSecrets

Also on request: internal network and Active Directory (assumed breach), red team engagements, mobile apps and wireless. Scoped individually after a call.

Something blended, or not listed here?

Mobile apps, wireless, attack-surface discovery, or a scope that spans two of the above: tell us what you're trying to answer and we'll propose a shape for it.

Talk it through →

Pricing

Vallum Proof, and fixed packages around it.

Vallum Proof is our core engagement: a full test of your app and its API, the attestation letter, and a free retest — everything you need to satisfy an audit or a customer review. Smaller and larger scopes sit on either side of it. Every price is fixed after a 30-minute call.

Launch Check

from $4,200 / from €3,900

1 web app or 1 API, up to 3 roles, report, free retest. 3–4 testing days.

The core engagement

Vallum Proof

$7,500 / €6,900

Web app + its API + full role matrix up to 6 roles, report, attestation letter, free retest. 6–7 days.

Vallum Proof + Cloud

$9,600 / €8,900

Vallum Proof plus the cloud configuration review around that app. 8–9 days.

Annual plan

$12,900/year / €11,900/year

Vallum Proof once a year, plus a Launch Check after a major release. Priority scheduling.

Package	What's included	USD	EUR
Launch Check	1 web app or 1 API, up to 3 roles, report, free retest. 3–4 testing days.	from $4,200	from €3,900
Vallum Proof	Web app + its API + full role matrix up to 6 roles, report, attestation letter, free retest. 6–7 days.	$7,500	€6,900
Vallum Proof + Cloud	Vallum Proof plus the cloud configuration review around that app. 8–9 days.	$9,600	€8,900
Annual plan	Vallum Proof once a year + a Launch Check after a major release, priority scheduling.	$12,900/year	€11,900/year

Other work (internal network, red team, mobile) from $1,200 / €1,100 per day, quoted after a call.

Payment: 50% at kickoff, 50% on delivery of the report. Quotes in MAD available for clients in Morocco.

Every price is fixed after a 30-minute scoping call. Any change of scope is quoted before work starts.

Audits

For audits, regulators and customer reviews.

What auditors expect from a pentest, and what you walk away with.

What auditors expect from a pentest

Testing by an independent, qualified third party
A defined scope, test dates and methodology (OWASP, NIST SP 800-115)
Findings rated by severity, with evidence
Proof that critical and high findings were fixed (a retest)
A test at least once a year, and after major changes

What you receive

The full technical report
An executive summary for leadership
An attestation letter you can share with auditors and customers without technical detail
A free retest within 30 days and an updated letter
A mapping of the test to ISO 27001:2022 controls 8.8 and 8.29, and to SOC 2 CC4.1 and CC7.1

Also relevant for SAMA CSF and NCA ECC in Saudi Arabia, and DORA for EU financial entities. Always confirm what your auditor or regulator requires.

Also useful when a customer's security questionnaire asks for a recent penetration test report — the report and attestation letter above are built to answer that directly.

Scope

Which engagement do you actually need?

These three are the ones people most often mix up. Internal & AD and Red Team are scoped individually after a call; here's exactly what each covers.

	Web / API Pentest	Internal & ADAssumed breach	Red Team
Goal	List and rate every finding	List and rate every finding, from inside	Reach one agreed objective, undetected
Starting point	External, credentials provided	Internal foothold assumed	Zero knowledge, real-world entry
Reconnaissance	Light	Light	Extensive, including OSINT
Phishing / social engineering	—	—	Where authorized
Coverage style	Comprehensive	Comprehensive, internal scope	Objective-based: depth over breadth
Report style	Findings list, CVSS-rated	Findings list, CVSS-rated	Narrative timeline + findings
Typical duration	3-10 days	5-10 days	2-4 weeks
Best for	Audit and compliance evidence	Testing defense-in-depth	Testing people, process and detection

Not sure which fits? Tell us what you're trying to prove to your auditor, your board or your customers, and we'll tell you plainly which one answers it, or whether you need both.

Fit

Who this is for, and who it isn't.

A good fit

A small or midsize business with a website, app, network or cloud setup to protect — SaaS, fintech, logistics, health and e-commerce are common, but not a limit
A customer, regulator or auditor is asking for a penetration test report
You want one senior person accountable, not a rotating team
You have a non-production environment (or a maintenance window) and someone technical who can answer questions

Not a fit

You want a scanner run relabeled as a penetration test
You need 24/7 monitoring or managed detection
You need a team of ten testers for a multi-week red team
You want a clean report whatever the testing finds

The deliverable

A report your engineers can act on and your auditor can file.

01
Executive summary with overall risk and the top three actions, for leadership and customers.
02
Findings with CVSS scores, CWE references, evidence and reproduction steps, for engineers.
03
Attack chains showing how findings combine, so you fix the right things first.
04
Remediation roadmap with owners, effort and target dates.
05
Positive findings, so the report also shows what is working.
06
Attestation letter you can share with auditors and customers without exposing technical detail.

Request the full sample report Book a scoping call

PDF · 8 pages

NW-PT-2026-014 · FINDING F-01SAMPLE, FICTIONAL CLIENT

HighCVSS 8.1CWE-639

Cross-tenant access to invoices

Description

The invoice endpoints check that the user is logged in but not that the invoice belongs to the user's organization. Invoice IDs are sequential, so any customer can read or edit any other customer's invoices.

Evidence

GET /api/v2/invoices/1043 Authorization: Bearer [Tenant A, Customer User] 200 OK {"org_id":"org_b81", ...}

Remediation

Check the invoice's organization against the caller's in the data layer for every read and write, and add automated cross-tenant tests.

Whole report: 11 items

2 High4 Medium3 Low2 Info

Process

From first call to retest in about five weeks.

DAY 0

Scoping call

30 minutes. A written fixed-price quote follows within 2 working days.

DAY 2-7

Authorization

NDA, letter of authorization, test accounts for each role, and our source IP on your allow-list.

WEEK 2

Testing

3-5 days for a mid-size application. Critical findings reach you within 24 hours.

WEEK 3

Report and debrief

Report within 2 working days of testing, then a call to walk your engineers through it.

WEEKS 4-6

Retest

Fixes for critical and high findings are retested within 30 days, with an updated attestation letter.

Scope estimator

See roughly how many days your test needs.

Set the size of your platform. The estimate is indicative, because the fixed price comes from a short scoping call.

Payment is 50% at kickoff and 50% when the report is delivered.

Web applications

Customer app, back office, widgets

APIs

Public and internal interfaces

User roles

Distinct permission levels to test

Add a cloud configuration review Add internal network and Active Directory testing

Indicative effort

8-11 days

$8,800–$12,100 / €8,000–€11,000

Indicative price, excl. VAT. The fixed price comes from the scoping call.

Request a quote for this scope Book a scoping call

Behind Vallum

Who leads your engagement.

Ismail Regragui

Founder · Lead penetration tester

I lead every Vallum engagement. I've run offensive security work for banks, healthcare and technology clients and presented findings to executives and engineers alike.

I've tested live targets as a member of the Synack Red Team, and I explain technical risk in terms boards and regulators understand, helped by a PhD in political science from Sciences Po. Vallum works in English, French and Arabic.

Why Vallum? It is the Latin word for the rampart of earth and stakes that marked a Roman frontier. A line is only as strong as its weakest point, and finding that point is the job.

OSCPOffensive Security Certified Professional

OSEPOffensive Security Experienced Penetration Tester

BSCPBurp Suite Certified Practitioner

OSWPOffensive Security Wireless Professional

Trust

What's already in place.

DPA with EU Standard Contractual Clauses available on request Data deleted 90 days after the retest

Questions

What teams ask before they start.

Will testing affect our production environment?

By default we test a staging environment with test data, so production is not touched. If production testing is needed, we agree the rules in writing first: request rates, hours, and an emergency contact on your side.

What do you need from us to start?

A staging environment with test data, accounts for each role, API documentation or an OpenAPI file, our source IP allow-listed on your firewall, and written authorization from the system owner.

What happens if you find a critical issue?

You hear about it within 24 hours, with enough detail to start fixing, instead of waiting for the final report.

Can the report go to our auditor and customers?

Yes. The report is written for that purpose, and we also provide a short attestation letter you can share without exposing technical detail.

How is the price set?

You get a fixed price after a 30-minute scoping call, based on the number of applications, APIs and roles and the depth you need. Any change in scope is quoted before work starts.

How do you handle our data?

Findings and evidence stay on a dedicated, encrypted machine and are shared only through a channel you approve. Unless you ask otherwise, working data is deleted 90 days after the retest.

Do you use AI tools? Is our data safe?

We use AI tooling to speed up parts of our workflow, correlating recon data and drafting report sections, but it runs on infrastructure we own and control, not a third-party AI product. Nothing about your systems, credentials or findings is sent to an outside AI service. Every vulnerability is still verified and exploited by hand before it goes in the report.

Where do you work from?

Vallum is based in Rabat, Morocco, and works remotely with clients worldwide. The NDA and authorization letter name the source IP addresses we test from, so your team can recognize our traffic.

Do you work with companies in the GCC?

Yes — remote testing from Rabat; the time zone is 2-3 hours from the Gulf, and reports come in English or Arabic. Government and critical-infrastructure work that needs local licensing, such as NCA in Saudi Arabia or DESC in Dubai, isn't offered yet.

Which currency do you invoice in?

USD or EUR, and MAD for clients in Morocco.

Can you sign our NDA and DPA?

Yes. For EU clients, the DPA includes the Standard Contractual Clauses.

Tell us what you want tested.

Send your application, your deadline, and the audit or customer review that needs the report. You will get a scoping call and a fixed-price quote.

Book a 30-minute scoping call Email us Connect on LinkedIn

Prefer email? ismail@vallumsec.com · mailto links don't open for everyone, so this address is plain text you can copy.