NewCREST-accredited · AI security testing

Continuous Penetration Testing.
Real Security Assurance.

Expert-led pentesting for applications, APIs, cloud and AI-powered apps. Uncover exploitable vulnerabilities, collaborate directly with testers and verify remediation through one platform.

Talk to a Security ExpertSee the Platform

Trusted by security and engineering teams at

Partly logoPaySauce logoEROAD logoBlack Pearl logoLawVu logoDevoli logo
Jacques Labuschagne
“We would highly recommend Capture The Bug to anyone who needs continuous assurance and speed without compromising depth.”

Jacques Labuschagne

Chief Technology Officer, PaySauce

Nathan Taylor
“Thanks to their continuous monitoring and clear communication, we’ve built a more resilient and security-aware development process.”

Nathan Taylor

Chief Operating Officer, Partly

Shai Bhula
“The platform made it easy to scope, schedule, and track the test in real time, no long email chains or delays.”

Shai Bhula

Chief Technology Officer, Whip Around

Testing that keeps pace with change.

Each release can reshape your risk. Ongoing testing helps you spot new exposure, prioritise what counts and verify each fix.

  • Expanding attack surface

    API added

    New APIs, features and integrations can introduce exposure a single assessment may not cover.

  • Gaps in visibility

    Coverage: unclear

    Without regular testing, it can be hard to see what's covered and where exposure remains.

  • Fragmented remediation

    Owner: none

    When findings sit outside engineering tools, ownership and progress become harder to follow.

  • Unverified fixes

    Fix: unverified

    Until a fix is retested, there's no evidence the risk is actually closed.

Five steps to verified remediation.

A disciplined, specialist-led process with clear visibility from kickoff to closure.

Talk to a Security Expert
Scope
Planning

Define your scope

Agree assets, objectives and boundaries with your assigned specialists.

Asset listRules of engagement
Test
Underway

Expert-led testing

Specialists combine a structured methodology with hands-on testing.

Manual testingRecognised methodology
Review
Validated

Review validated findings

Each finding is checked by a specialist and supported by evidence.

EvidenceSeverity rating
Remediate
Fixing

Resolve the issues

Work through fixes with clear guidance and direct specialist access.

Fix guidanceSpecialist support
Retest
Verified

Verify each fix

Request a retest within your engagement terms and record the result.

Retest recordAudit trail

One clear view of your security testing.

Manage scope, review findings and follow remediation in one place, from assessment to assurance.

app.capturethebug.xyz/

Risk score

41

down from 72 last quarter

Open critical

2

Assets tested

38/42
AssetTypeLast testedFindings
app.vertex.ioWeb app2d ago
api.vertex.io/v2REST API5d ago
graphql.vertex.ioGraphQL12d ago
admin.vertex.ioWeb appUntested

We don't just test what AI says. We test what attackers can make it do.

Our specialists assess AI agents, connected tools, data access and trust boundaries the way a real attacker would.

Explore AI Penetration Testing

What we assess

  • agent.exec

    Agent and tool execution

    Whether an AI agent can be pushed into running actions or tools it should not use.

  • ai → data

    AI-to-data access

    How far a model or agent can reach into databases and sensitive business data.

  • prompt.inject

    Prompt and document manipulation

    Whether injected instructions in prompts or documents can change how the system behaves.

  • trust.boundary

    Trust boundaries

    Where AI components meet your core systems, and where those boundaries can break down.

Real outcomes from teams that ship fast.

View all stories
FastCo

FastCo caught a critical vulnerability within 24 hours

A Singapore HR-technology company moved from delayed, end-of-engagement reporting to expert-led PTaaS, with early findings, direct collaboration with the testers and Slack and Jira workflows.

To first finding
< 24 hrs
Vulnerability caught
Critical
Slack & Jira workflows
Live
Read case study
DevoliTelecommunications & technology

How Devoli built a more flexible security testing programme with Capture The Bug

CREST-certified penetration testing for evolving technology platforms, with context-aware assessments, tailored reporting and direct collaboration with skilled pentesters.

Read case study
FileInviteSecurity & compliance

FileInvite kept its SOC 2 testing on track, starting within 24 hours

Web and API testing across two customer portals began within 24 hours of sign-off, with evidence delivered on schedule.

Read case study

Why Capture The Bug

Assurance you can verify.

Independent accreditation, recognised methodology and experienced specialists behind every engagement.

Every assessment is delivered within an agreed scope, with human-validated findings, specialist technical review and clear remediation evidence.

Accreditation

CREST-accredited penetration testing

Capture The Bug holds CREST accreditation for penetration testing.

One of the first four companies in the world, and the first in New Zealand, to achieve CREST Security Testing of AI accreditation.

Verify on the CREST Marketplace
CRESTCREST accredited Security Testing of AI
CREST AI Charter signatory badge

CREST AI Charter signatory

We have signed the CREST AI Charter for the responsible use of AI in security services.

Methodology

Recognised methodology

Testing aligned with OWASP ASVS, OWASP MASVS, the OWASP API Security Top 10 and the OWASP Top 10 for LLM Applications.

  • OW

    OWASP ASVS

    Application Security Verification Standard

  • OW

    OWASP MASVS

    Mobile Application Security Verification Standard

  • OW

    OWASP API Top 10

    API Security Top 10

  • OW

    OWASP LLM Top 10

    Top 10 for LLM Applications

Specialist oversight

Engagements are led by experienced security specialists, including researchers with published CVEs.

Secure testing practices

See how we handle credentials, customer data and security findings.

Visit the Trust Center

Your findings, inside your tools.

Connect validated findings with your engineering workflows, reducing manual handovers and keeping remediation visible.

Expert testing across your entire stack.

Specialist testing for applications, APIs and AI, along with mobile, cloud and network environments.

Verified fixes / sprintLive
+18

Continuous Penetration Testing

Recurring expert assessments planned around your release cadence and changing security priorities.

  • Testing planned around your releases
  • Findings shared with your engineering team
  • Assurance evidence across cycles
Explore continuous penetration testing
agent.execUnapproved tool callExploited
ai → dataData access scopePassed
prompt.injectDocument injectionExploited
trust.boundaryCore system boundaryPassed
agent.execTool permission limitsPassed
prompt.injectInstruction overrideExploited

AI Penetration Testing

Adversarial testing of LLM applications, AI agents, connected tools and the data they can reach.

  • Agent and tool execution testing
  • Data access and trust boundaries
  • Prompt and document injection
Explore AI penetration testing
app.acme.com/checkout
Stored XSS · /search?q=HIGH

Web Application & API Testing

Manual testing of authentication, roles, business logic and APIs, aligned with OWASP ASVS and the API Top 10.

  • Access control and logic flaws
  • Tenant isolation testing
  • Evidence for each finding
Explore web and API testing
Cert pinningBypassed
Root detectionPassed
Keychain storagePassed
Jailbreak detectionBypassed
Deep link handlingPassed
Debug flagsPassed

Mobile App Testing

iOS, Android and hybrid apps assessed statically and at runtime, in line with OWASP MASVS.

  • Code and runtime analysis
  • Local data and session checks
  • App to backend traffic review
Explore mobile app testing
Attack path: role → RDS

Cloud & Infrastructure Testing

AWS, Azure, Google Cloud and network testing focused on the paths a real attacker would take.

  • Identity and permission review
  • Internal and external network tests
  • Attack path analysis
Explore cloud and infrastructure testing
SOC 2 Type II94%
ISO 2700186%
PCI DSS72%

Compliance-Aligned Testing

Penetration testing evidence organised for SOC 2, ISO 27001, PCI DSS and HIPAA assurance programmes.

  • Findings mapped to relevant controls
  • Retest records for resolved issues
  • Executive and technical reports
Explore compliance-aligned testing
Considering a red team exercise? Talk to us

One-off or continuous? Choose the right testing approach.

Both have a place. The right choice depends on how often your environment changes and what you need to prove.

One-Off Penetration Testing

  • Assessment of an agreed scope
  • Suited to a defined release or assurance requirement
  • Findings and remediation evidence from the engagement
  • Retesting according to engagement terms
  • New testing commissioned as required

Best for: a specific release, audit or customer requirement

Explore penetration testing

Continuous Penetration Testing

  • Recurring assessments across an evolving scope
  • Suited to frequent releases and changing environments
  • Ongoing visibility across assessment cycles
  • Retesting and collaboration under programme terms
  • Testing planned around changing security priorities

Best for: teams that release often and need ongoing assurance

Explore continuous penetration testing

Not sure which fits? Talk to a Security Expert

Build Confidence In What You Ship.

Talk to a specialist about one-off testing or an ongoing programme, scoped to your applications, environment and security goals.

Talk to a Security ExpertSee the Platform
Acme Corp Core API

Active Findings

Last updated 2 hours ago

2 Critical4 High

SQL Injection in User Authentication

VULN-042

Stored XSS in Comment Field

VULN-041

Insecure Direct Object Reference (IDOR)

VULN-040

Missing Rate Limiting on Login

VULN-039