Local storage and configuration
Sensitive records, credentials, or security settings exposed in files or application configuration.
Utilities Studio / Cybersecurity
Thick-client penetration testing
Find out whether changing the desktop client can bypass your controls.
Assess desktop applications for exposed secrets, insecure local data, and trust in client-side controls. Test the client and agreed backend interfaces.
Your engineers need to know where the fix belongs.
Your desktop application stores sensitive records or connects to internal services. A finding needs to distinguish local behavior from a permission the server should enforce. We assess the installed client and agreed backend interfaces, with evidence that helps your engineers identify the component responsible.
The assessment
Thick-client penetration testing
Thick-client penetration testing examines a desktop application and the services it communicates with. We assess local data handling and the controls implemented in the client, then investigate whether manipulating the client affects server-side access or behavior. The scope identifies the supported operating system, application build, and backend coverage.
Inside the scope
Client-side controls
Business rules and access decisions that depend on behavior inside the desktop application.
Backend communication
The requests and data exchanged with the server, including authentication and authorization in scope.
Trust boundaries
The effect of a modified or unexpected client interaction on protected data and operations.
What your team receives
- An executive summary explaining the business impact and what the assessment covered
- Technical findings that identify the affected component and give your engineers evidence and reproduction steps
- Remediation guidance for the affected components and a findings review with your team
- Retest results for the agreed findings, with rounds, time window, and pricing specified before booking
Working with your team
From scope to remediation.
Scope the work and agree delivery
Confirm the assets, permissions, and production limits. Name the contacts and record the dates, reporting format, support arrangements, and retest terms.
Test and share the evidence
Investigate the agreed attack paths and validate findings. Keep your team updated and escalate critical issues immediately through the agreed channel.
Review findings and verify fixes
Walk your engineers through the report and remediation priorities. Carry out the agreed retesting and document which fixes worked and what remains unresolved.
What are you paying for?
Application architecture, operating systems, local components, user roles, and backend access affect the effort. Installation requirements and test-environment setup are established before quoting.
Planning around your deadline
The schedule includes access to a working installation and representative backend services. We agree the build and operating environment before assessment begins.
Pentest delivery
Know what to expect before the test starts.
When will we see findings?
We share validated findings during the test through the agreed secure channel. Critical issues go to your nominated contact immediately. Progress updates cover completed work, blockers, and what comes next.
What will the report contain?
Your engineers get affected assets, reproduction steps, evidence, and remediation guidance. We explain severity using the demonstrated impact. An executive summary sets out the business risk and the limits of the assessment.
Who helps us work through the fixes?
A technical findings review lets your engineers discuss the evidence and recommended fixes with us. We name the technical contact and agree the support period and response arrangements before testing.
What does retesting cover?
Retesting checks fixes to the original findings and records the result. Before booking, we specify the findings covered, retest rounds, time window, and any charges. New features or changed environments need a scope review.
Can findings go into our issue tracker?
We agree the findings format and handover method with your team. If you use Jira, Linear, or GitHub, we scope the export or ticket handover, required access, and treatment of sensitive evidence before testing.
When can we start and get the report?
Your proposal sets the start date, testing window, and report delivery date after we review scope and access. Bring your audit or release deadline so remediation and retesting can be planned around it.
Delivery references: NIST SP 800-115 and CREST's penetration testing programme guide.
The practitioner behind the work
Led by Sheeraz Ali.
Sheeraz Ali is our Head of Cybersecurity. His work spans application, cloud, network, and AI assessments. His personal track record includes leading pentests at Cobalt and building the internal pentest programme at SolarWinds.
Read Sheeraz's security backgroundSheeraz's personal track record
- Pentest engagements at Cobalt
- 245
- Vulnerabilities identified at Cobalt
- 1,592
- CVEs discovered
- 28+
- Machines and labs authored at Hack The Box
- 300+
His website lists OSCP, CRTP, CRTE, CREST CRT and CPSA, CBBH, and CKA.
At SolarWinds, he delivered 120+ internal pentests. As CTO at Pwned Labs, he built a platform serving 40,000+ practitioners. He co-developed Mobexler, selected for Black Hat Arsenal, and presented research at Nullcon and c0c0n.
Explore his career timelineFAQ
Questions before you book.
What is a thick client?
A thick client is an application installed on a user device that performs substantial work locally, often while communicating with backend services. Desktop business applications are a common example.
Is a desktop assessment the same as a web application test?
No. A desktop assessment includes the installed client and its local data or behavior. It may also include backend testing, but that coverage must be agreed explicitly.
Why test controls already built into the application?
A user controls the machine running the client. Testing investigates whether changing local behavior can bypass a business rule or gain access that the server should independently restrict.
We had a pentest last year. What should we test now?
Bring the previous report and a list of changes to your code, permissions, or infrastructure. We can use those to scope the next assessment. Check which earlier findings were fixed and which fixes were verified; the date on the old report does not answer those questions.
Explore related assessments
All cybersecurity servicesAPI penetration testing
Assess API authentication, object-level authorization, role boundaries, and sensitive data exposure. Get evidence your developers can reproduce.
Network penetration testing
Assess internal and external networks for exploitable services, access weaknesses, and routes to sensitive systems. Get evidence and remediation priorities.
Penetration testing services
Manual penetration testing for your applications, cloud, and networks. Get validated findings with reproduction steps, business impact, and guidance for your engineers.
What do you need to get moving?
Tell us what your team needs to resolve, which systems are involved, and any deadline. We will work through the scope and reporting needs with you.