Home / Continuous / Access
Access
The part of your application only real users can reach. Access tests it with credentials, across roles, on a defined rotation.
What it covers
- Access control between roles, including horizontal and vertical privilege escalation
- Business logic and workflow abuse, which is where automated tooling is weakest
- Session handling, authentication flows and password reset paths
- Injection and input handling across authenticated surfaces
- API authorisation: object-level and function-level access control, and excessive data exposure
How the work is carried out
A consultant directs this module and does the work that needs judgement, with automation carrying the continuous load between their passes. Your intervals are set during onboarding and recorded in the service agreement, because a schedule that suits one application would be wrong for a large, sprawling estate. What is fixed is the shape: a scheduled layer that runs the same checks on fixed intervals so change is visible, and an exploratory layer that a consultant directs based on what turns up. Reporting is monthly.
What the tooling handles
- Keeps authenticated crawling and endpoint enumeration current as the application changes
- Flags candidate issues across every role for a consultant to pick up
- Repeats constrained, non-destructive checks only
What our consultants do
- Test the application by hand across every role, using the credentials you provide
- Build the role model and work out what each role should and should not be able to do
- Perform business-logic testing and chain findings into a real attack path
- Confirm every finding before it is reported
Every finding in this module is reproduced or confirmed by a consultant before it reaches you.
What you receive
- Validated findings, each reproduced or confirmed by a consultant
- A monthly written report, including what changed since the last one
- Critical and high findings notified within one business day of validation
- Re-testing after you ship significant changes
- Verification of fixes once you have applied them
What is out of scope
- Source code review. This module tests the running application, not the repository
- Mobile application binaries, which are scoped as separate point-in-time work
- Denial-of-service and load testing, which are blocked by default
- Social engineering of your users, which is the People module
Prerequisites
Nothing runs until these are in place. We pause rather than proceed against an unconfirmed register.
- Credentials for each role we are asked to test, with a test account per role
- Accounts we can safely manipulate, ideally in a non-production environment
- API documentation or a request collection, where one exists
- Signed authorisation and a confirmed asset register