Overview
What is a web application vulnerability assessment?
A web application vulnerability assessment finds, checks and rates the security weaknesses in a web application, so you can fix the most serious first. Ants Creation (Pvt) Ltd’s own security team carries it out under a written authorisation and an NDA.
It combines automated scanning with a person’s review: each possible weakness is checked, false alarms are removed, and the rest are rated by how much risk they carry.
It suits a regular check-up, or a first step before a full penetration test.
What is included
What does a vulnerability assessment cover?
How it works
How does a vulnerability assessment work?
01
Scope and authorise
The systems in scope and the testing window are set out in a written authorisation you sign, alongside an NDA.
02
Map
We map the target and how it is used, so testing covers what matters.
03
Scan and review
We scan the application, then check each finding to see which are real.
04
Report
Each finding is rated by severity, with the evidence and the steps to fix it.
05
Re-test
After you fix the issues, one re-test of the fixed issues is included.
Why Ants Creation
Why assess your web applications with Ants Creation?
Since 2011, Ants Creation has completed 700+ projects for 400+ clients in Sri Lanka and abroad.
Scanner or assessment
Is an automated scanner enough?
An automated scanner is a good start, but on its own it is not enough. It checks quickly for known types of weakness, but it also reports false alarms, and it cannot judge whether a user can reach data that is not theirs or whether a workflow can be misused.
| Scanner on its own | Our vulnerability assessment | Penetration test | |
|---|---|---|---|
| Known types of weakness | Found automatically | Found by scanning, then checked | Found, then safely exploited |
| False alarms | Left for you to sort out | Removed by our security team | Removed by our security team |
| Access control and business logic | Cannot be judged | Covered by a penetration test | Tested by our security team |
| What you receive | A list of possible weaknesses | Findings rated by severity, with evidence and fixes | Findings rated by severity, with evidence and fixes |
| Re-test of fixed issues | Not included | One re-test included | One re-test included |
If your application handles orders, payments or approvals, or users who should see only their own data, a penetration test checks what a scanner cannot.
Common questions
Web application vulnerability assessment: frequently asked questions
How is a vulnerability assessment different from penetration testing?
A web application vulnerability assessment finds, checks and rates weaknesses across the whole application, using automated scanning and a review of each finding by Ants Creation’s security team. Penetration testing goes further: it safely exploits weaknesses and tests sign-in, access control and business logic, to show what an attacker could actually reach. Many organisations run assessments regularly and a penetration test when the risk calls for it.
How often should we run one?
Many organisations run a web application vulnerability assessment a few times a year, and after major releases, because new weaknesses are found in plugins, libraries and themes all the time. A site that changes often, or relies on many plugins, benefits from more frequent checks. Ants Creation’s security team can recommend a schedule based on how often your application changes.
Does it cover WordPress and Shopify sites?
Yes. Ants Creation’s vulnerability assessment covers WordPress and Shopify sites as well as custom web applications, including themes, plugins, settings and outdated components with known weaknesses. Because our web team also builds WordPress, Shopify and custom applications, our developers can fix what the assessment finds if you want them to, and one re-test of the fixed issues is included.
What happens afterwards?
You receive a report ranked by risk, with the evidence and the steps to fix each finding, so the most serious issues are fixed first. Your own developers or Ants Creation’s can make the fixes. After that, one re-test of the fixed issues is included, to confirm each issue is closed. If the risk calls for it, the next step can be a penetration test.
Do you use a web application security scanner?
Yes, as one part of the assessment. Ants Creation’s security team in Sri Lanka runs automated scanning for known types of weakness, then checks every finding before it reaches your report, so false alarms are removed and real issues are rated by risk. The assessment is carried out under a written authorisation and an NDA, and one re-test of the fixed issues is included.
Related services
Tell us what you need.
Tell us what you need, and we will recommend the right next step. No obligation, no sales script.