How long does an Authorized Web & API Security Assessment take?

Most engagements run 1-3 weeks depending on the size of the attack surface (number of hosts, endpoints, and applications in scope). The 48-Hour Secure Digital Workflow Assessment is the faster entry point that determines whether a deeper assessment is warranted.

Authorized Web & API Security Assessment Kenya

Most Kenyan businesses discover a security problem the same way: a customer reports something strange, a payment fails oddly, or a partner's compliance team asks a question nobody can answer. By then the question is no longer "are we exposed?" but "how long have we been?"

An Authorized Web & API Security Assessment answers that question on your terms, under written permission, before someone else answers it for you.

Who this is for

SMEs, startups, NGOs, and established teams running a public web application, a customer portal, or an internal API that touches personal or financial data. It is particularly relevant if you are:

Handling customer personal data that needs careful technical safeguards.
Being asked for a security attestation by an enterprise client, bank, or donor before contract signature.
Running a product built quickly under deadline pressure, where security review was deferred.
Integrating third-party services, webhooks, or AI agents that hold credentials to your systems.

What gets reviewed

The assessment uses the OWASP Top 10 and the OWASP API Security Top 10 as its structural baseline, verified by hand rather than by scanner output alone. Automated tooling finds candidates; a human confirms whether each one is actually exploitable in your context.

Review Area	What Is Examined
Authentication & Session	Login flows, session lifetime, token handling, password-reset abuse paths, multi-factor coverage.
Authorization	Broken object-level authorization (BOLA), privilege escalation between roles, tenant isolation.
Input Handling	Injection surfaces, unsafe deserialization, file-upload handling, server-side request forgery.
API Surface	Undocumented and legacy endpoints, rate limiting, mass assignment, excessive data exposure in responses.
Configuration	Security headers, TLS configuration, CORS policy, verbose error output, exposed admin paths.
Secrets & Credentials	Keys in client bundles, repository history, environment misconfiguration, third-party token scope.
Data Protection	PII at rest and in transit, logging leaks, retention behaviour, technical data-handling safeguards.

The boundary: permission before testing

RULES OF ENGAGEMENT

No assessment begins without a signed scope defining exactly which hosts, applications, and endpoints are in scope, which are explicitly excluded, the testing window, and the escalation contact. Testing is non-destructive by default. Denial-of-service, social engineering of staff, and any activity against systems outside the agreed scope are excluded as a matter of policy, not negotiation.

POINT-IN-TIME ASSESSMENT — NOT A CONTINUOUS GUARD

This assessment is a time-boxed checkup (~1–3 weeks) that uncovers current vulnerabilities and tells you how to remediate them. It does not guarantee your systems can never be attacked, and it does not include ongoing 24/7 security monitoring afterwards.

What you receive

Findings register: each issue with severity, affected surface, reproduction steps, and evidence.
Plain-language risk summary: written so a non-technical director or board can act on it, not just an engineer.
Remediation guidance: specific fixes with implementation notes, ordered by risk against effort.
Data-handling findings: technical gaps in storage, transmission, access and logging are flagged.
Retest pass: confirmation that closed findings are genuinely closed, not merely reported as closed.

Evidence and method

The methodology behind this service is documented publicly rather than asserted. See the SOC incident walkthrough for triage and investigation approach, and the KDPA Developer Checklist for how regulatory obligations are translated into code-level controls. Commercial delivery experience is recorded in the Munar security baseline and handover.

Frequently asked questions

How long does an assessment take?

Most engagements run 1-3 weeks depending on the size of the attack surface. The 48-Hour Secure Digital Workflow Assessment below is the faster entry point that determines whether a deeper assessment is warranted.

Do you use automated scanners, or is this manual testing?

Both. Automated tooling surfaces candidate issues quickly, but every finding reported is manually verified as actually exploitable in your context before it reaches the findings register.

Will testing disrupt my production systems?

Testing is non-destructive by default and scoped under a signed rules-of-engagement document beforehand. Scans are scheduled to avoid disrupting your business (typically during off-peak hours). Denial-of-service techniques and anything outside the agreed scope are excluded as policy.

Does this assessment check customer-data handling?

Yes. We flag technical issues with encryption, access controls, logging and data sharing alongside OWASP-based security findings. Legal interpretation belongs to an advocate.

How engagements start: the 48-Hour Secure Digital Workflow Assessment

Most clients begin with the 48-Hour Secure Digital Workflow Assessment, a fixed-fee, fixed-scope discovery engagement, delivered jointly with HarLyn Digital Partners, that establishes the current-state map and identifies whether a deeper technical assessment is warranted.

Map the attack surface: hosts, applications, APIs, and credential exposure in scope.
Isolate the highest-risk findings: the flaws most likely to cause real damage first.
Deliver the risk summary: a plain-language report a non-technical director can act on.
Hand over a prioritised remediation roadmap: ranked by risk against effort, ready to execute.

START HERE

Engagements begin with a fixed-scope scoping call. Clear decisions before code, and no obligation to proceed to follow-on build work.

Request a Scoping Call →