Overview

An application vulnerability assessment is a code-level review of a whole custom application, measured against a published benchmark so the results mean something to the people who asked for them. For web applications and APIs, that benchmark is the OWASP Application Security Verification Standard (ASVS). For mobile apps, it is the OWASP Mobile Application Security Verification Standard (MASVS).

It is the broadest of our application security services, and the one to choose when a customer, auditor, or procurement office asks whether your application meets a recognized standard. You receive an audit-style findings report they can read, with each finding tied to the requirement it fails.

What This Assessment Covers

This assessment covers your whole custom application, in breadth. We read the source code, confirm what we find with targeted testing, and assess the application against the ASVS or MASVS requirements that apply to it.

Need something adjacent?

If your concern is specifically how users sign in and what each user can reach, our fixed-price authentication and access control audit covers that slice in more depth, with a proof test for every confirmed finding.
If you want to know how mature your organization’s secure development process is, see our secure development program assessment (OWASP SAMM).
If the application uses large language models or AI agents, see our AI agent and LLM security assessment.

The Benchmark

ASVS 5.0 groups its requirements into 17 chapters, from encoding and sanitization through authentication, authorization, cryptography, and logging, and defines three verification levels, L1 through L3, each adding depth. MASVS groups its controls into categories such as storage, cryptography, authentication, network communication, platform interaction, code quality, resilience, and privacy.

We agree on the standard and the level with you before the assessment starts, and we exclude requirements that don’t apply to your application, so the report covers what matters for it. For a closer look at the two standards, see OWASP ASVS and MASVS application security reviews.

How We Work

One of our mottos is “Code Review before Pen Test.” We start with the code, because that is where the application makes its security decisions. A typical assessment involves an initial consultation, security code review of the application source, dynamic testing where it adds evidence, a findings report, and collaboration on remediation strategies with your team.

Languages and Frameworks

We review backend and frontend application code in whatever your application is built on. Authentication, authorization, input handling, and data access follow the same principles in every language, and the standards we assess against are language-neutral, so we bring the same rigor to a stack we haven't reviewed before. Our first Django audit and our first audit of a Java application on Tomcat were both in stacks that were new to us.

Applications we review include:

Backend: Ruby on Rails, Python (Django, Flask, FastAPI), Java (Spring, and applications on Apache Tomcat, including legacy code), and JavaScript or TypeScript on Node.js
Frontend: React, Angular, Vue, and other JavaScript or TypeScript applications
APIs: REST and GraphQL
Mobile: iOS and Android apps, assessed against OWASP MASVS

If your application is built on something else, ask us. We review that too.

AI-Assisted Review

With your authorization, we use AI assistance to conduct in-depth code reviews, which saves time and money. You decide where your code is processed: with our contracted U.S.-based AI providers, on offline models, or exclusively within your organization's own AI infrastructure. We can also review without AI assistance, which may increase the timeline and cost of the engagement.

We use AI assistance to audit code, not data. Before any AI is used, we analyze your repositories for secrets and other sensitive data, in the latest code and throughout the commit history, since a credential deleted from the code can still sit in an earlier commit. TruffleHog is one tool we use for this, and we use a variety of other tooling as each engagement requires.

We work within the frameworks this page describes, and when the code is available, we write unit tests that demonstrate each suspected shortcoming or exploit. At no time do we take the output of an AI model and present it as a finding. Our team reviews every finding thoroughly before it reaches your report.

What You Receive

A findings report mapped to the ASVS or MASVS requirements in scope, with the severity of each finding and actionable recommendations.
A list of the requirements we excluded as not applicable, and why.
An optional signed attestation or bridge letter from Frank Rietta, a life member of OWASP, for your customers or auditors.

Fixing what we find is a separate engagement, handled through our vulnerability management and remediation solutions.

Not Authorized by OWASP

Please note that OWASP does not accredit or authorize specific companies to conduct assessments against ASVS or MASVS. Our use of their mark on this page is for fair use only to clearly identify the standards that we follow. You are free to read and follow these standards on your own or use any consultant or contractor of your choice. OWASP also does not certify vendors, verifiers, or software, and does not endorse any claim of ASVS certification, as the ASVS itself states.

Frank Rietta is a life member of OWASP, believes strongly in their mission, and supports the local club organization.

Application Vulnerability Assessment