Try Our Comprehensive
Yet Cost-Effective Web App Security Assessment Right Now

We've been conducting security assessment for years, and now we offer the first-ever cost-effective web application manual security assessment.

Trusted Tools

Find security errors with manual assessment and Gujian scanner. In Gujian we have automated most labor-intensive tasks with highly sophisticated tooling. Get access to Gujian used by pentesters and security professionals around the world.

Attacker Focused

Hunt vulnerabilities from the attackers perspective. Simulating real world penetration scenarios and proving impact for each security issue instead of presenting reports with false positives.

Manual assessment

Reports show that 80% of web applications are, in fact, vulnerable if checked manually. Real security assessment are mostly done manually by highly skilled IT security experts. A manual assessment provides much more coverage and value

Security Assessment vs Vulnerability Scan

Most SaaS security assessment offers are, in fact, vulnerability scanning with one or several tools, followed by manual reporting.

Real security assessment are mostly done manually by highly skilled IT security experts. A manual assessment provides much more coverage and value, but it comes at a price.

We have over 10 years of manual security assessment experience in a highly competitive market.

Now we can offer comprehensive web application security assessment for an affordable price.

We have automated most labor-intensive tasks with highly sophisticated tools.

Automated Scanning Is Not Enough

Most online web applications are continuously probed for vulnerabilities by different kinds of bots and scanners every hour. In other words, your adversary is already conducting vulnerability scanning for you.

If your apps haven't been hacked yet, then automated tools were unable to find even one of potentially many security issues within them.

Reports show that 80% of web applications are, in fact, vulnerable if checked manually.

When a motivated adversary targets an application and does so manually, there is a high chance of getting hacked even if it was scanned. Unless security issues in your applications have already been uncovered and fixed - and that is where we can help.

Get Actionable Results

We build confidence by providing professional consulting at every interaction with our customers. The outcome of every security assessment is a detailed risk posture of your online applications, and is threefold:

First, in the executive summary, we present an overview of the current security level of the target applications and relevant security threats.

Second, we provide a detailed description of each security issue with precise information on how to reproduce it (a test case with relevant screenshots) and how to remediate it.

Last but not least, we provide a summary of existing security features in the checked web applications. This is often missed in security reports. You will see which application aspects were implemented properly, such as authentication, authorization, session management, XSS protection, etc.

Our Process

There are several questions we shall consider and agree upon before we start:

Scope of the engagement.

Duration of the engagement and timeframe allowed for testing.

Disallowed activities (such as attacks on customers, DoS-related actions, etc.).

Credentials for testing the client area of applications (if in scope).

Other technical questions based on our customer checklist.

During an engagement, we provide reports with the current status every week. Finally, we provide a detailed technical report with the results of the security assessment.

We support our customers via several communication channels to be able to answer every single question they have about the process of an ongoing activity.

Why Gujian?

A good success record:

We have 10+ years of manual security assessment and know exactly how it should be done.

We have academic experience – most of our experts are graduates from University's Security Lab and have and appsec R&D background.

Our methods and tooling proved effectiveness on real world applications at bug bounty programs. Where lots of experts missed security issues, our approach revealed ones.

We have a track record of finding 0-day vulnerabilities in common software like WordPress, VMWare, etc.

Our penetration team members successfully participate in CTFs to challenge themselves and improve their skills in worldwide competitions.

Try Our Comprehensive Yet Cost-Effective Web App Security Assessment Right Now