Black box penetration testing for web apps, APIs and networks
OVERLORD Team LTD is a UK team that runs black-box penetration tests of web apps, APIs and networks. You get a written report with evidence, a CVSS risk rating and a fix list. A scan-based Lite test is $250, and Plus with manual testing is $500.
What you get
We look at the public surface the way an outsider would: the site, the APIs, and the hosts you put in scope. You get a written report with evidence, a risk rating, and fixes listed in the order that matters.
A black-box security audit starts with no inside access, so we see only what an outsider would. If your app has logins and the budget covers only a few days, a grey-box test with an account for each role covers more of the app for the same money. We will say which fits your scope.
Lite is a scan and a short summary. Plus and above add manual checks for the usual web flaws. Pro and Enterprise can widen the exercise if that is what you asked for. When you compare vendors, ask what is in scope and whether a retest is included. The report is a list of findings you can ticket, with steps to reproduce. We do not sell a PDF that nobody can act on.
What we test
Web, mobile, and desktop applications against a written scope
Network checks on firewalls, VPNs, and the servers you name
Cloud configuration on AWS, Azure, or GCP when those accounts are in scope
A wider simulated attack when you buy Pro or Enterprise
Phishing or staff-awareness tests only if you put them on the order
A hardening pass after you patch, if you want the same team to retest
What you receive
Audit report with an executive summary and a technical appendix
Risk scores using CVSS so engineering can sort the queue
A live walkthrough of critical findings on Pro and Enterprise
A remediation list with a suggested order
Optional retest after you say the fixes are in
How we test
OWASP Top 10 as the baseline for web work
A scan first, then manual work on anything that looks real
Black-box by default; grey-box with test accounts when logins are in scope
Rules of engagement signed before we touch production
Critical findings reproduced by hand before they go in the report
We will test against a standard you name (PCI, ISO 27001) if you supply the checklist
Web application penetration testing
We test your web application the way an outsider would, against a scope we agree in writing. Beyond the scan, manual checks look for the usual web flaws, such as weak login handling, injection and broken access rules, and a finding is reported with the steps to reproduce it.
Lite is a scan with a short summary. Plus adds manual testing of common exploits. Pro is an in-depth manual test in which we exploit and validate each finding.
CREST, CHECK and what to ask a provider
CREST is an accreditation body for penetration testing providers, and CHECK is the NCSC scheme for testing UK government and public-sector systems. Some buyers, insurers and contracts require one or the other. This page does not claim CREST or CHECK status for OVERLORD Team LTD. If your contract requires an accredited provider, confirm that before you buy, from any vendor.
Whichever provider you pick, ask what is in scope, who does the manual testing and whether a retest is included. Our tiers suit different jobs. Lite ($250) is a first look at a small site. Plus ($500) suits a web app or API where manual testing of common exploits matters. Pro ($2,500) suits an application that holds customer data and needs each finding exploited and validated. Enterprise ($10,000) is an organization-wide simulation with a C-level briefing.
Pricing Tiers
Starting prices in USD. The quote follows the written scope.
Frequently asked questions
Short answers about Security Audit & Penetration Testing. If your case is different, send the brief.
What is a black-box penetration test?
A black-box penetration test looks at your site, APIs and hosts the way an outsider would, with no inside access unless you grant it. We try to prove what an attacker can actually do, then report the evidence, a CVSS risk score and the order to fix things in.
How much does a penetration test cost?
Lite is $250 for a vulnerability scan and summary report. Plus is $500 and adds manual testing of common exploits. Pro is $2,500 for an in-depth manual penetration test in which we exploit and validate each finding; it is not a red team engagement. Enterprise is $10,000 for an organization-wide simulation. We agree the scope in writing before we test.
What do I get at the end?
A report with an executive summary and a technical appendix, CVSS risk scores, steps to reproduce each finding, and a remediation list in a suggested order. Pro and Enterprise add a live walkthrough of critical findings, and a retest after your fixes is optional.
Is a vulnerability scan the same as a penetration test?
No. A vulnerability scan lists known issues, while a penetration test tries to prove what an attacker can do. Our Lite tier is a scan with a short summary, and Plus and above add manual testing on anything that looks real.
Do you retest after we fix the findings?
Yes, as an option. After you tell us the fixes are in, the same team can retest. When you compare vendors, ask what is in scope and whether a retest is included.
Also see
Ready to get started?
If this page matches the job, send the brief. We will say no if it does not.