A B2B SaaS company approaching its Series A had hit a wall that is now standard in enterprise software: a prospective customer's procurement team required an independent web application security test before signing. The internal team was competent but conflicted — you do not grade your own homework — and the deal, worth over a million euro, was paused pending the report. This engagement became Bureau Null's first external Web Application Security Test, and the template for every one since.
The scope was the production web application and its API, tested both unauthenticated and as a range of authenticated user roles. The methodology followed the OWASP Testing Guide and ASVS, with every finding scored under CVSS 3.1 so the client could triage objectively rather than by gut feel. The deliverable was not just a vulnerability list but a prioritised 90-day remediation roadmap written for their actual team size — a plan they could execute, not a document designed to frighten them into a retainer.
Systematic coverage of the OWASP Top 10 and beyond: injection, broken access control, session management, business-logic abuse and API-specific weaknesses — across both anonymous and authenticated contexts.
Seventeen findings, each with reproduction steps, evidence, CVSS 3.1 vector and business-impact context — readable by the CTO, actionable by the developers, defensible in front of procurement.
Findings sequenced by risk and engineering effort into a realistic plan: criticals in week one, structural fixes across the quarter, quick wins flagged for immediate closure.
A verification pass after remediation confirming each fix held — the document procurement actually needed to see, closing the loop with evidence rather than promises.
Total findings, including two criticals: an IDOR exposing other tenants' records and a stored XSS in the admin panel. Both were patched within two weeks.
Value of the enterprise contract unblocked when the retest report passed the customer's procurement security review.
Of critical and high findings verified as remediated in the retest — the client now holds an annual retesting retainer.
// results vary by project — ask us how we measured this one
“The report found what we could not see and, just as importantly, told us what to fix first. Procurement signed a month later. It was the cheapest revenue we ever unlocked.”
CTO, Vanguard Security client · NDA engagement — reference call availableA fixed-scope security engagement ends with findings ranked by severity, reproduction steps and a remediation plan your team can execute. No theatre, no fear marketing.