Fenko penetration tests are delivered through Foxhound, which is where the assessment model and the controls around it are described. This page is the detail underneath: what we cover in each discipline.
Coverage is breadth and depth together. Automated steps work through published methodology against your approved scope, so coverage stays consistent between engagements. A tester then goes after what methodology alone will not surface: business logic flaws, chained vulnerabilities, and access control gaps that only show up once you understand how the application is meant to work.
Blackbox, greybox, or whitebox, scoped to whatever makes sense for your environment and threat model.
Web Application Testing
Full-depth testing against your web applications, covering the OWASP Top 10 and well beyond it. We test for injection flaws (SQL, NoSQL, LDAP, command), cross-site scripting, broken authentication and session management, insecure direct object references, server-side request forgery, and misconfigurations in web servers, frameworks, and CDNs. We also look at things like WebSocket handling, client-side storage, and CSP bypasses. If your app handles file uploads, payments, or multi-tenant data, those get dedicated attention.
Mobile Application Testing
iOS and Android. We reverse-engineer the application binary, inspect local data storage, analyse network traffic, and test the backend APIs the app relies on. Coverage includes certificate pinning validation, insecure data storage (Keychain, SharedPreferences, local databases), inter-process communication, deeplink handling, and runtime manipulation. We test against the OWASP Mobile Top 10 and flag platform-specific issues that scanners routinely miss.
API Testing
REST, GraphQL, gRPC, and SOAP. We map every endpoint, test authentication and authorisation at each layer, fuzz input parameters, and look for data exposure through verbose error messages, excessive response fields, and broken object-level access control (BOLA/IDOR). Rate limiting, mass assignment, and injection via serialised payloads all get covered. If you have API documentation (OpenAPI specs, Postman collections), we’ll use it. If you don’t, we’ll enumerate from scratch.
Network Infrastructure Testing
External and internal. On the perimeter side, we run port scanning, service enumeration, and protocol-level testing across your public-facing infrastructure. We look for exposed management interfaces, default credentials, outdated TLS configurations, DNS misconfigurations, and services that shouldn’t be internet-facing.
For internal testing, we assess what an attacker could do once inside your network. Active Directory attacks, lateral movement paths, credential harvesting, network segmentation validation, and privilege escalation. If you need it, we can simulate a full assumed-breach scenario starting from a standard user workstation.
Cloud Security Testing
AWS, Azure, and GCP. We review IAM policies, storage bucket permissions, network security groups, serverless function configurations, and container orchestration setups. Cloud pentesting is different from traditional network testing because the attack surface lives in configuration as much as in code. We test for privilege escalation through misconfigured roles, data exposure via overly permissive storage policies, and lateral movement between cloud services.
AI and LLM Security Testing
Prompt injection, jailbreak testing, training data extraction, agent tool abuse, and data exfiltration through model outputs. If you’re running autonomous agents with tool access, we test whether those tools can be manipulated into performing unintended actions. We also assess guardrail effectiveness, system prompt leakage, and whether your RAG pipeline can be poisoned through its data sources. This is the testing we built Fenko around.
Standards we test against
OWASP WSTG v4.2, the OWASP Top 10, API Top 10 and LLM Top 10, OWASP MASTG for mobile, PTES, and NIST SP 800-115. Findings are scored with CVSS 4.0 and mapped to CWE. Where you need it mapped to a compliance framework, we cover NZISM v3.9, ISO 27001:2022, SOC 2 Type II, PCI DSS v4.0, NIST 800-53 Rev 5, and the CIS AWS Foundations benchmark.