Lexs Security

Our Services

From a single web application to a full red team exercise, every test is shaped around your systems and carried out by experienced, hands-on testers.

Web Application Testing

We test your web application the way a real attacker would: by hand, with patience and creativity. Scanners pick up the obvious bugs; we find the logic flaws and chained attacks that only a person would spot.

  • Login, session and password-reset weaknesses
  • Access control: can users see or change data that isn't theirs?
  • Injection, cross-site scripting (XSS) and server-side request forgery
  • Business-logic abuse, such as skipping payment or approval steps
  • Testing as a guest, a regular user and an admin

Network Penetration Testing

Starting from the internet or from inside your office, we find out how far an attacker could get. You'll know which doors are open, how we got through them, and how to close them.

  • External testing of everything you expose to the internet
  • Internal testing, including Active Directory attacks
  • Privilege escalation and movement between systems
  • Checks that your network segments and firewalls hold up
  • Weak, default and reused credentials

API Security Testing

APIs often trust more than they should. We test your REST and GraphQL APIs to see whether users can reach each other's data, call admin functions, or pull far more than your app ever shows.

  • Object- and function-level authorisation flaws
  • Excessive data exposure and mass assignment
  • Token, session and API key handling
  • Missing rate limits and resource abuse
  • Input validation and injection

Cloud Security Review

Most cloud breaches start with a single misconfiguration. We review your AWS, Azure or Google Cloud environment for exposed storage, loose permissions and leaked secrets, and show you how an attacker could chain them together.

  • Identity and access (IAM) misconfigurations
  • Publicly exposed storage, databases and services
  • Secrets and keys left in code, configs or logs
  • Container and Kubernetes security
  • Comparison against CIS security benchmarks

Mobile Application Testing

We take your iOS or Android app apart to see what it stores on the device, what it sends over the network, and what its backend lets through. Testing follows the OWASP mobile security standard.

  • Sensitive data stored insecurely on the device
  • Network traffic, encryption and certificate pinning
  • Reverse engineering and tamper resistance
  • Authentication and session handling in the app
  • Full testing of the backend APIs the app relies on

Social Engineering & Red Teaming

Often the easiest way in is a convincing email or phone call. We run realistic phishing campaigns and goal-based attack simulations to test your people, processes and defences together.

  • Phishing and phone-based (vishing) campaigns
  • Goal-driven red team operations
  • Testing how well your team detects and responds
  • Clear debrief for leadership and staff
  • Practical security awareness recommendations

What every engagement includes

Scope

We agree what will be tested, how and when, so every test is authorised and there are no surprises.

Test

Our testers work through your systems by hand, chaining weaknesses together the way a real attacker would.

Report

You receive a clear report with an executive summary, risk-rated findings, evidence and step-by-step fixes.

Retest

Once your team has applied the fixes, we test again to confirm every issue is properly closed.

Not sure which test you need? Tell us about your product and we'll recommend the right one.

Get a quote