Manual pentesting for systems that move money.
Test authentication, access control and payment logic across your web applications and APIs. Get reproducible evidence and clear remediation priorities.
Unique findings across client engagements. Laboratory and unattributed research findings excluded.
Security Packages
Choose a starting point. Final price and delivery dates depend on the agreed assets, roles and workflows; the starting prices do not imply unlimited coverage.
External Surface Review
An agreed domain and asset list.
FIXED QUOTE AFTER SCOPING
- Attack surface inventory
- Exposed services and configuration
- Validation of selected exposures
- Prioritised executive summary
Authenticated application testing is quoted separately.
Discuss RECONFocused Web & API Pentest
An agreed application scope and priority user journeys.
FIXED QUOTE AFTER SCOPING
- Authentication and access control
- Selected business logic workflows
- Manual validation and reproducible PoC
- Technical report and remediation call
Roles, endpoints and workflows are agreed before the quote.
Discuss COREExtended Application Assessment
A broader review of connected application components.
FIXED QUOTE AFTER SCOPING
- Cross-service vulnerability chains
- Agreed web, API and mobile scope
- Targeted code or cloud review if scoped
- Retest of reported issues included
The statement of work names the assets and retest window.
Discuss DEEPSecurity Assessment Programme
A coordinated assessment across agreed systems.
FIXED QUOTE AFTER SCOPING
- Application and architecture review
- Agreed infrastructure and source scope
- Technical and executive reporting
- Scheduled remediation verification
Testing cadence, team and compliance evidence are scoped individually.
Discuss TOTALDiscovery to Verification
Six steps. Manual expertise and systematic coverage at every stage.
Discovery Call
We learn your stack, priorities, and threat model. You get an honest assessment of what we can deliver.
Reconnaissance
Mapping your attack surface — domains, APIs, services, technologies. We find what's visible and what shouldn't be.
Deep Testing
Manual testing by senior researchers. Business logic, authentication, authorization, injection, race conditions.
Chain Building
Individual findings linked into attack chains showing real-world damage paths. Not just "vulnerable" — "here's the impact."
Report & Present
Technical report with PoC for every finding. Executive summary for leadership. Live walkthrough of critical issues.
Verify Fixes
After your team patches — we retest every finding. Clean verification report confirms the fixes work.
Selected Engagements
Anonymous excerpts from recent assessments. All findings verified with reproducible PoC. Read the counting methodology.
A payment-platform assessment covering payment logic, access control and transaction workflows. 77 reported findings, including 12 Critical and 28 High.
An assessment of authentication and authorisation across an exchange. 45 reported findings, including 8 Critical and 15 High.
An anonymised engagement aggregate from our 2025–2026 client corpus. Counts shown here are specific to this engagement; technical details are not disclosed on this page.
Deep Expertise Where It Matters
Application security for financial workflows, account boundaries and transaction integrity.
FinTech & Banking
Payment systems, mobile banking, transaction processing. PCI DSS testing and payment flow analysis.
Crypto & DeFi
Exchanges, wallets, trading platforms. Withdrawal flow testing, API key security, smart contract interaction.
iGaming & Betting
Sports betting, casino platforms. RNG analysis, balance manipulation, real-time protocol testing.
E-Commerce
Online stores, marketplaces. Cart manipulation, coupon abuse, inventory race conditions.
SaaS & Cloud
Multi-tenant applications. Tenant isolation, privilege escalation, data leakage between accounts.
Healthcare
Patient portals, telemedicine. HIPAA-relevant testing, PII protection, access control.
Research & Case Studies
Deep dives into vulnerability classes, testing methodology, and real engagement results.
Top 10 Vulnerabilities in FinTech Apps
IDOR, race conditions, JWT flaws, KYC bypass. A checklist for scoping financial application tests.
Where Scanners Need Manual Testing
Seven areas where application context matters.
How Much Does a Pentest Cost in 2026?
Price ranges, what drives cost, red flags in vendor quotes, and the ROI math.
Evidence your engineers can act on
Vigil Continuum Group focuses on manual application security assessments for fintech, crypto and gaming platforms.
Understand the workflow
We examine who can perform an action, which preconditions must hold, and what changes when requests are replayed or combined across services.
Make findings actionable
Reported findings include a reproducible proof of concept, impact, testing conditions and remediation guidance. Scope and limitations are documented alongside the results.
Written scope
Assets, roles, environments and testing windows agreed before work starts.
Coordinated testing
Rate limits, test accounts and escalation contacts agreed with your team. Production-impacting checks require explicit coordination.
Clear deliverables
Technical report, executive summary and remediation walkthrough. Retest coverage and timing documented in the proposal.
Common Questions
What happens on the free scoping call?
In 30 minutes we discuss your application, user roles, critical workflows and deadline. We use this to propose a scope and quote. The call is not a penetration test and does not promise findings.
What does the starting price cover?
A bounded scope agreed in writing. Application size, roles, integrations, access conditions and testing depth affect the final quote. Additional assets are scoped separately.
How long will the assessment take?
We agree delivery dates after reviewing the scope and access requirements. Your proposal separates the testing window, report delivery and retest period.
How do you protect production systems?
We agree approved environments, test accounts, request limits, testing windows and an emergency contact before starting. Destructive testing is excluded unless separately authorised.
What do we receive?
A report with severity, reproducible PoC, impact and remediation guidance; an executive summary; and a walkthrough with your team. DEEP and TOTAL include retesting within the agreed scope and window.
How are your published metrics calculated?
14,650 unique client findings from 2025–2026, deduplicated by finding ID or hash. Laboratory and unattributed research work is excluded. Of these, 1,053 have no recorded severity. See the methodology page for the complete breakdown.
How do we start?
Send your company, application type and deadline. We arrange scoping, then document deliverables, contracting details, payment terms and authorisation before testing begins.
Plan your next security assessment
A 30-minute conversation about scope, risk and delivery. No testing begins before authorisation.
Discuss your pentestBefore you commit
Inspect the work. Agree the scope.
Check relevant experience
Review the confirmed crypto and payment-platform cases.
Read the payment case →Get a written proposal
Agree assets, access, deliverables, fees and retest conditions.
Explore Web & API testing →Tell us what you need to test
Share the application type and your deadline. We will follow up to agree scope and next steps.