Managed engagement · Human-led

Request a penetration test.

This is the scoping conversation, not a purchase. Tell us what the system does and what decision the test has to support. We reply with a proposed scope, an approach, timing and the written-authorization steps before any testing is discussed in detail.

Do not include credentials, personal data, or details of an unpatched vulnerability in this form. If you already hold sensitive material, request a secure channel first.

Who is asking

Name Required

Work email Required

Organization Required

Your role

What needs testing

Surfaces in scope Required

Select everything that may be in scope. Scope is confirmed during the conversation, not here.

Web application API or backend service Cloud + integrations Mobile or desktop client AI or agent system External attack surface

Describe the system Required

What it does, who uses it, what it connects to, and what the worst realistic outcome would be if someone got in.

Environment to be tested

Why now

What decision does this test support? Required

Date you are working toward

An approximate month is fine. Tell us if something external sets the date.

Previous testing on this system

Authorization

WebCook Labs tests only with written authorization from someone entitled to grant it. This question does not authorize anything — it tells us who needs to be in the conversation.

I can reach the person who can authorize testing of this system.That may be you, or someone you can bring in. If a third party owns or hosts the system, say so below.

Anything else we should know

Third-party ownership, hosting constraints, testing windows, regions, or anything unusual about the environment.

Prefer email? Write to [email protected].

We use what you send here to scope the assessment and reply to you. See the privacy notice for how inquiry information is handled.

What happens after you send this

We read it and replyUsually with questions, because the first description rarely contains the boundary that matters.
We propose a scopeSurfaces, objectives, exclusions, timing and what the report will contain.
Authorization is signedWritten authorization from the party entitled to grant it. Testing does not begin before this exists.
Testing runsAgainst the agreed scope, with a named contact and an agreed route for anything urgent.
You receive the reportEvidence, reproduction steps, demonstrated impact and prioritized remediation.

Response time

We respond to most inquiries within 24 hours. If your timeline is urgent, say so in the request and we will prioritize the reply.

Not sure this is the right engagement?

If you want repeated testing of a product that changes often, the self-service platform may suit better — though it supplements a human-led assessment rather than replacing one.

If you are reporting a vulnerability in a WebCook product rather than commissioning work, use the vulnerability-reporting route.