Evidence from a real engagement
HighOne missing authorisation gate.
AI / LLM · Authenticated, non-admin
1 High · 2 Medium · 4 Low
Follow the evidenceIndependent since 201410 published CVEsRetest included
Find what scanners miss.Prove it. Verify the fix.
Manual penetration testing and red teaming by senior engineers. Every finding comes with reproducible evidence, and every fix is retested.Senior engineers.
Evidence for every finding.
Scroll to follow the path
Beyond the surface
Follow the path.
Prove the impact.
An exposed application is the starting point. We follow access boundaries to the data they should protect.
01 / An attack path, illustratedPublic applicationExposed endpoint
02 / An attack path, illustratedIdentity boundaryAccess rules
03 / An attack path, illustratedProtected dataSensitive asset
Map the exposed surface.
Where we fit
Automation finds the hostname.
We find the business logic.
Automated and AI-driven platforms are good at breadth: inventories, known exposures and frequent checks. A specialist engagement adds depth. Our engineers learn how your system is meant to work, chain small weaknesses into demonstrated impact, and stand behind every finding in a live debrief.
Investigate the whole system
From a mobile binary to its backend API, or an AI feature to its administration permissions: we agree the boundaries, accounts and workflows, then investigate how they interact.
See an AI authorisation caseWork directly with the testers
Senior engineers perform the assessment, document reproducible evidence and explain the results in a technical debrief. Your team can discuss the finding with the people who investigated it.
See how an engagement runsVerify the remediation
Our penetration tests include a remediation retest. We check the reported fixes and confirm the results in writing, so closure is supported by evidence.
See what the report containsOur AI security service assesses applications with AI features: permissions, data paths and agent authority. That is a different question from whether a testing tool uses AI. Explore AI security testing
Compare automated and specialist testingHow an engagement runs
From first question
to verified fix.
The same five stages on every penetration test. Critical issues reach your team as soon as they are confirmed, and the engagement closes only when the fix is proven. See the full methodology
- 01
Scope
Objectives, targets, rules of engagement and emergency contacts agreed in writing. You receive a fixed timeline and quote.
- 02
Map
We learn the application the way an attacker would: roles, routes, trust boundaries and the business workflows behind them.
- 03
Exploit
Senior testers chain weaknesses by hand into demonstrated impact. Safe proof, no destructive actions.
- 04
Report
An executive summary for leadership and a technical report for engineers, walked through in a live debrief.
- 05
Retest
Included as standard. We repeat the attack against your fix and confirm in writing what is closed.
Engagement log
- 01Objectives and exclusions agreed
- 01Rules of engagement signed
- 01Fixed timeline and quote issued
- 02Roles mapped: admin, member, second tenant
- 02Routes, APIs and trust boundaries enumerated
- 02Workflows walked with real test accounts
- 03Member session reaches an admin-only operation
- 03Chained to cross-tenant data access · High
- 03Flagged to your team as soon as confirmed
- 04Evidence and reproduction for every finding
- 04Fixes ranked by real risk
- 04Live debrief with your engineers
- 05Same request replayed after your fix
- 05Server refuses it: boundary enforced
- 05Retest letter issued · finding closed
Stage5 / 5
Findings1 High · 2 Medium
StatusClosed
Evidence, not assumptions.
From a finding
to a verified fix.
Every finding we report carries the proof behind it, the change that fixes it, and the retest that shows it is closed. Pick an example.
Invoice API exposes other tenants' data
- Affected
GET /api/v2/invoices/{id}- Impact
- Any signed-in customer can read every other customer's invoices, addresses and VAT details by changing one number.
- 01Evidence
What we sent, and what came back.
GET /api/v2/invoices/10424 HTTP/1.1Host: app.example.testCookie: session=…← signed in as tenant A HTTP/1.1 200 OK← request succeeds{"invoice_id": 10424, "tenant": "tenant-b",← another tenant's record "amount_due": "4150.00"} - 02Fix
The change your engineers make.
invoice = Invoice.get(id)invoice = Invoice.get(id, tenant=session.tenant)← checked in the serviceif invoice is None: raise NotFound() - 03Retest
The same attack, after the fix.
GET /api/v2/invoices/10424 HTTP/1.1← same request, same userHTTP/1.1 404 Not Found← another tenant's invoice is unreachableRetested 12 days later: closed
Unauthenticated RCE on the build server
- Affected
ci.internal.example.test- Impact
- A missing auth check let us run commands as the service account and reach source code and deploy keys.
- 01Evidence
What we sent, and what came back.
POST /api/v1/jobs HTTP/1.1Host: ci.internal.example.testContent-Type: application/json← no credentials sent {"script": "id"}← harmless proof command HTTP/1.1 201 Created← job accepted{"output": "uid=998(runner)"}← ran as the service account - 02Fix
The change your engineers make.
listen: 0.0.0.0:8080listen: 10.20.0.5:8080← build network onlyauth: sso_required← every job needs a signed-in user# exposed deploy keys rotated - 03Retest
The same attack, after the fix.
POST /api/v1/jobs HTTP/1.1← same request, no credentialsHTTP/1.1 401 Unauthorized← job refusedRetested 8 days later: closed
Password reset tokens are predictable
- Affected
POST /auth/reset- Impact
- Tokens derived from a timestamp let an attacker take over any account knowing only the email address.
- 01Evidence
What we sent, and what came back.
POST /auth/reset HTTP/1.1token issued: 1761469201-7f3a← Unix time + a fixed suffixtoken issued: 1761469262-7f3a← one minute later GET /auth/reset/confirm?token=1761469263-7f3a← guessed, never issuedHTTP/1.1 200 OK← "Choose a new password" - 02Fix
The change your engineers make.
token = f"{int(time.time())}-{SUFFIX}"token = secrets.token_urlsafe(32)← unguessableexpires = now() + timedelta(minutes=15)← short-lived - 03Retest
The same attack, after the fix.
GET /auth/reset/confirm?token=1761469263-7f3a← same guessed tokenHTTP/1.1 400 Bad Request← "Invalid or expired token"Retested 15 days later: closed
Stored XSS in support ticket fields
- Affected
iOS & Android app, ticket subject- Impact
- A crafted ticket ran script in the agent's console, exposing other customers' conversations.
- 01Evidence
What we sent, and what came back.
POST /api/tickets HTTP/1.1← sent from the iOS app{"subject": "<img src=x onerror=alert(1)>"}HTTP/1.1 201 Created← stored as written agent console › ticket #5521alert(1) on support.example.test← script ran in the agent's session - 02Fix
The change your engineers make.
<td>{{{ ticket.subject }}}</td>← raw HTML<td>{{ ticket.subject }}</td>← escaped by the template - 03Retest
The same attack, after the fix.
agent console › ticket #5522← same payload<img src=x onerror=alert(1)> shown as text← no script runsRetested 6 days later: closed
Findings anonymised from real engagements. Requests, hosts and data are synthetic, in the same format as our reports.
Cover
Executive summary
Summary of findings
Finding with evidence
What you receive
The same structure in every report, so leadership can act on page four and engineers can work from page eleven.
- Executive summaryRisk and priorities on two pages.
- Technical findingsEvidence and reproduction for each issue.
- Remediation guidanceFixes ranked by real risk.
- Live debriefA walkthrough with your engineers.
- Retest letterWritten proof of what is closed.
Structured to support evidence for ISO 27001, SOC 2, PCI DSS, DORA and NIS2.
From our work
Real work. Real consequences.
Real engagements, anonymised to protect our clients. See the scope, evidence and outcome.
Critical
Enterprise software vendor
A shipped mobile app that was a credential vault
1 Critical, 5 High — remediated
Read the case study
High
Banking
Hardened, but not finished: a high-value transaction app
16 findings, SoD redesign path
Read the case study
High
Enterprise software vendor
The AI admin plane that never checked for an admin
1 High, 2 Medium, 4 Low — one root cause
Read the case studyExpertise for every attack surface.
Choose testing for your applications, infrastructure or defences. We help you agree the right scope, then deliver evidence your team can act on.
Agreed scope
Penetration Testing
Manual testing of web, mobile, API, network and cloud targets that proves real, chained impact.
View serviceRed Teaming
Goal-based adversary simulation across people, process and technology that measures detection and response.
View serviceCloud Penetration Testing
Configuration review and hands-on exploitation across AWS, Azure and GCP — identity, data, workloads and the paths between them.
View serviceMobile Application Security
Manual testing of iOS, Android and cross-platform apps against the OWASP MASVS — the binary, the data on the device, the runtime and the API behind it.
View serviceAI / LLM Penetration Testing
Testing for embedded AI and LLM features that starts with the administration plane — prompt configuration, model lifecycle, pipeline credentials and ingestion — not with jailbreak strings.
View serviceSecure Development
Secure code review, threat modelling and architecture guidance, plus custom tooling for your stack.
View serviceExpertise you can put to the test.
Our engineers hold demanding, hands-on certifications. Most are earned in timed, hands-on exams against live lab targets rather than multiple-choice tests.
OSCE³OffSec Certified Expert
OSWEOffSec Web Expert
OSEPOffSec Experienced Penetration Tester
OSEDOffSec Exploit Developer
OSCPOffSec Certified Professional
CRTOCertified Red Team Operator
CRTLCertified Red Team Lead
CRTECertified Red Team Expert
CRTPCertified Red Team Professional
BSCPBurp Suite Certified Practitioner
CREST CRTCREST Registered Penetration Tester
CPSACREST Practitioner Security AnalystTrusted with the work that matters.
Long-standing clients, some with us since our first year. Names are withheld: we work under NDA by default.
PXLSec's team is very talented and committed, and strives to get the job done. Their penetration testing skills are top-notch, at both network and web application level. Their reporting and communication skills are very good too.
PXLSec provides professional IT security analysis and advice. The team demonstrates expertise and is thorough in its work. We have been impressed with their attention to detail and highly recommend their services.
We hired PXLSec to analyse our website for potential security threats. We got the top vulnerabilities listed, along with a way to mitigate them. This helped us reduce the chances of an attack.
PXLSec provides top-notch security services with a focus on making things right for their clients. I would highly recommend anyone looking for cyber consultants to give them a try.
PXLSec has helped us with a number of security activities and we have always been very pleased with the quality and delivery.
Questions clients ask
Anything else? Email [email protected] and a tester will answer.
How long does a penetration test take?
Most web application or API tests take one to two weeks of testing, depending on scope. Red team operations usually run for several weeks. You receive a clear timeline in the proposal.
How is pricing determined?
Pricing is based on scope and effort and agreed in writing before testing starts. Penetration tests include a remediation retest within the agreed scope and window. For other assessments, recurring scans or additional testing rounds, the proposal states what validation is included.
Will testing disrupt our production systems?
Safety comes first. We agree rules of engagement, testing windows and emergency contacts up front, and avoid destructive techniques unless you explicitly authorise them. Staging environments are welcome.
Do you help with compliance requirements?
Yes. Our reports are structured to support evidence for ISO 27001, SOC 2, PCI DSS, DORA and NIS2, and we can map findings to the specific controls in your audit.
Can you sign our NDA and supplier paperwork?
Yes. PXLSecurity LTD. is registered in Bulgaria (VAT BG203239331) and routinely works under client NDAs, DPAs and vendor-onboarding processes.
Do you work internationally?
Yes. We work with clients across Europe and beyond, remotely or on-site according to the agreed scope.
Send us one URL.
Tell us what it is and what worries you about it. A senior tester usually replies within one business day with questions, a proposed approach and a quote.
Confidential from the first conversation
We can sign your NDA before you share sensitive details. Your enquiry is covered by our privacy policy.
How we protect your information · Privacy policy