SaaS and platforms
Can a user get premium without paying? Can one customer see another customer's data? I test the logic behind your product, not only the OWASP checklist. You get findings your developers can reproduce and fix the same week.
MSPs & GRCFirst white-label test at no cost to you
Penetration testing that finds what scanners miss.
Manual web and API testing focused on business logic: payment and billing flows, tenant isolation, access control, race conditions. Fixed price after a 30-minute scoping call. A written report you can hand to your customer, insurer or auditor.
# Account A's token used against a device owned by Account BDELETE /v2/thermostats/<THING_ID_OWNED_BY_B>/ HTTP/1.1Host: api.<redacted-vendor>.comAuthorization: Bearer <REDACTED_JWT_ACCOUNT_A>HTTP/1.1 200 OK{"success": true}Built for products and partners that need proof.
MSPs
Sell penetration testing to your clients without hiring a tester. I test under your brand, deliver in your report template, and you keep the client relationship. Typical triggers: a cyber insurance questionnaire, a client's customer asking for proof, a new service line in your catalog.
GRC consultancies (ISO 27001, SOC 2, vCISO)
Your client's audit needs a technical test with evidence. I deliver it white-label, scoped to what the auditor asks for, on the audit's timeline.
One client’s pentest under your brand, at no cost to you.
Pick one client who needs an external test or has an audit this quarter. I’ll run it under your brand at no cost to you.
- Up to 16 external hosts or one small web app
- Full report plus a 1-page summary the insurer or auditor accepts
- Revisions and retesting until the auditor signs off
- You bill at your price and keep all of it, plus the fix list to upsell as a remediation project
- After that, partner rates. If an auditor or insurer rejects a report, you don’t pay for it
- I don’t sell managed services or remediation and never take your clients directly. A non-solicit clause goes into our agreement
Book a 15-min call (opens in a new tab)
One pilot per partner. Testing starts after your client signs a testing authorization.
What the report contains
A document your developers can act on and your insurer or auditor can accept. Short and to the point: no filler pages, no pie charts nobody reads.
- Summary for management: overall risk and the top issues in plain language
- Each finding: severity (CVSS), what an attacker can actually do with it, steps to reproduce, evidence (screenshots, HTTP requests), how to fix it
- What was tested and held up, so you can see the coverage
- Retest results for the fixed issues, in an updated version of the report
Four steps, fixed price.
From $3,000 for a small web application. The exact price is in the written test plan after the scoping call.
Scoping call, 30 minutes
What is in scope: application, roles, environments, API, timeline. You get a written test plan, timeline and fixed price within 24 hours.
Testing
Manual testing against the plan. Written update every 2-3 days. Critical findings reported the same day, with a workaround if one exists.
Report and walkthrough
The report plus a call to go through the findings with your developers. For white-label engagements, with your client's team under your brand.
Retest
After fixes, within 90 days of the report, I re-verify every finding and issue the updated report.
Who is doing the testing
The person on the scoping call is the person who tests and writes your report. No account managers, no handoff to juniors.
40+penetration tests delivered
Alex Konoriev · Kyiv
- Web
- API
- Mobile
- IoT
- Medical devices
- Windows desktop
Penetration tester and security engineer.
I am Alex Konoriev, a penetration tester and security engineer based in Kyiv. Before testing I built security infrastructure at Samsung and on Ericsson projects, which is why my reports read like something a development team can act on.
- HTB CWEE (Certified Web Exploitation Expert)
- 40+ penetration tests: web applications, APIs, mobile apps, IoT and medical devices, Windows desktop applications
- Cybersecurity part of an FDA premarket submission for a medical device
- EU Cyber Resilience Act readiness for an IoT product: penetration test, SBOM and third-party component analysis, GDPR
- Fully automated MITRE ATT&CK for ICS attack simulation, used to train OT threat detection software
- Samsung: hardware-backed cryptography engine shipping on 100M+ Galaxy devices. Ericsson projects: security pipelines in the SDLC, critical trouble report resolution
Common questions
Will testing affect production?
Scope and testing windows are agreed in writing before I start. I prefer a staging environment; on production I avoid destructive tests unless you sign off on them explicitly, keep request rates low, and never extract data beyond what is needed as proof.
Do you need the source code?
No. Black-box testing works without it. Source code review is available as an add-on and usually finds more in less time.
How long does it take?
A typical SaaS application with login, a few user roles and an API: 40 to 60 hours of testing. I confirm the hours and the timeline after the scoping call.
How much does it cost?
From $3,000 for a small web application. Larger scopes get a fixed price in the written test plan after the scoping call.
What if you find nothing serious?
You still receive the full report of what was tested and held up. For an insurer or auditor that is the document they need.
How does white-label work?
NDA with you, report in your template and brand, no contact with your client unless you want me on the call. You set the price to your client. I don’t sell managed services or remediation, and a non-solicit clause goes into our agreement.
Do you also do SOC 2 or ISO 27001?
I do the technical testing and the evidence. I work alongside your GRC consultant or auditor rather than replacing them.
Get in touch
Scope it in
Scope it in
30 minutes.
Book a scoping call. You leave with a written test plan and a fixed price, whether or not you go ahead.
- Written test plan within 24 hours
- Fixed price, no obligation
- NDA on request