Traditional
Hands-on and precise.
- How it runs
- I work the application by hand, step by step.
- Best fit
- Production environments, where control matters most.
- Timeline and cost
- Sized to your application during scoping.
What I do
Application & API Pentesting
Your applications and APIs are where your customers' data lives, and they deserve testing from someone who has built software as well as broken it. I've been building software for 29 years and I bring all of it to every test I run, which is why every finding comes with remediation guidance your developers can actually follow.
What I test
Applications and APIs are what I test, guided by industry standards like the OWASP Top 10. Whether it's for a customer requirement or because you genuinely want to know where your exposure is, the work is the same: find the real risks and give you steps you can act on to reduce them.
Web applications
From a lone legacy PHP app that's been quietly running the business since 2011 to a sprawl of microservices nobody has fully mapped, I test the whole range. Modern stack or load-bearing antique, public cloud or your own datacenter, the question is the same: where does it break, and what does that cost you? I go find out.
APIs
The front door gets all the attention, but the API is where the real business logic lives, and often where the real holes are. I test them directly, the auth, the objects, the endpoints that assume nobody's looking.
Testing a chatbot, a RAG system, or an agent? That's its own service.
Two ways to run the test
Same test. Your choice of how it runs.
You get the same scope, the same standards, and the same deliverables whichever way we go. The difference is in how I do the testing, and I'll help you pick during scoping.
AI-augmented
NewAgentic tooling, working alongside me.
- How it runs
- Agentic tooling runs in the test harness alongside me, and I direct the work.
- Best fit
- Non-production environments.
- Timeline and cost
- A shorter timeline and lower cost.
Either way
- OWASP-guided testing
- Daily updates
- The full report
- Letter of attestation
- A readout
- 90 days of follow-up
How I work
Either way, I run your test. I use my experience to decide where to look, what's actually exploitable, and which findings are worth your attention.
I keep close to how AI and agents actually work, close enough to know where they help a test and where a careful human pass is the better call. That's why I give you a choice, and I'll tell you which one I think fits.
And if the right tool for your test doesn't exist? I engineer one. This is the Mechanical Drake way.
How an engagement runs
-
Before
Scope, agree, kick off
- A scoping call to size the work.
- An agreement and a statement of work.
- A kickoff call the week before testing, where we go over rules of engagement and access so you have time to get your environment ready.
-
2 days to 2 weeks
Testing
- How long depends on the application.
- Daily email updates throughout, because you should never wonder what's happening in your own environment.
- If I find something serious, I'll let you know that day rather than just adding it to the report.
-
2-week review
Report and readout
- A draft report, delivered over a secure channel.
- A readout call where I walk your team through what I found.
- Two weeks to review the draft before I finalize it.
-
90 days
After the report
- The people doing the fixing can bring me questions, and I'll make sure they can reproduce every issue.
- Once the high and critical findings are patched, I retest them and reissue the report and attestation.
If your developers have a question about a finding two months later, that conversation is included. I stick around after the report lands.
What you walk away with
Always included
- A report you can actually use. Structured the way the PCI Council
recommends, with the evidence and rigor that stands up to SOC 2, PCI DSS, HIPAA, and
GLBA expectations.
What's in the report
- An executive summary your leadership will read.
- Findings with a real discussion of risk and exact steps to reproduce.
- Remediation guidance your developers can act on.
- A narrative of how the testing actually went.
- A letter of attestation, at no extra cost. A separate document that says, in plain terms, what was tested and when. The thing you hand the auditor or the prospective customer when they ask for proof.
- A readout. I walk your team through what I found over a video call, so they hear it from me before they read it in the report. Bring your developers, bring your questions.
- 90 days of follow-up. Questions from the people doing the fixing, and a retest of your high and critical findings once they're patched.
Optional
Architecture session
Early in the test, you walk me through how the application is built. That turns a gray box engagement into a crystal box one, which means I'm testing with knowledge of how it works on the inside.
Questions I get
How long does a pentest take?
Testing itself runs anywhere from two days to two weeks, depending on the application. Around it sit the scoping call, a kickoff the week before, and a two-week review window on the draft report. When we scope, I'll give you a realistic timeline for yours.
How do you price?
I price each engagement on the effort the actual work takes. What moves the number is real stuff: how big the app is, how many user roles and tenants need testing, whether it's been tested before, how deep you need me to go, and which of the two methods fits. I work to understand your problem on the first call, and that's what your quote is built on, so you get a number without a drawn-out process to get there.
Do you work with other firms or MSPs?
Yes. If you're a firm or MSP that needs a US-based partner for overflow or specialized application work, I white-label cleanly and I don't poach your clients. Prefer to co-brand, or just refer the work and stay out of delivery? That works too.
Do you test mobile apps?
Yes. They don't lead my list because mobile engagements carry more setup overhead, certificate pinning, jailbreak and emulator wrangling, the usual gauntlet, but if your app is mobile, that's part of the job and I'm equipped for it. Bring it up when we scope and I'll plan for it.