Test it before
someone else does.
A scanner lists what looks weak. A penetration test shows what an attacker can actually use. We test your networks, applications and people, then stay with your engineers until the findings are closed.
- Internet facing systems and services
- Internal network and Active Directory
- Web and mobile applications
- APIs and cloud configuration
- Your staff, through phishing and pretext calls
Most reports get filed. Ours Get Used.
Most firms run a scanner, export the output and send you 300 pages of severity ratings. It satisfies an auditor. It does not tell your team what to fix on Monday morning.
We work the other way round. Every finding is checked by hand, ranked by what it would cost you, and written for the engineer who has to fix it.
Proof
Every issue is proven by hand. No raw scanner output reaches your report.
Impact
Findings are ranked by business impact, not by CVSS score alone.
Clarity
Each fix names the file, setting or control to change.
Expertise
Your engineers get a session with the tester, not just a PDF.
Ten ways in.
We Try All Of Them.
Scope only what you need. Most clients start with internet facing systems and web applications, then widen.
01
Web Applications
We test web applications for weaknesses that could expose sensitive data, bypass controls or give attackers unauthorised access.
02
Mobile Apps (Android & iOS)
We assess Android and iOS apps for security issues across authentication, data storage, APIs and communication with backend systems.
03
Application Programming Interfaces (APIs)
04
Thick Clients (Smart Applications)
We assess desktop and smart applications for vulnerabilities in application logic, local data, communication and authentication mechanisms.
05
Perimeter Network and Wi-Fi
06
Cloud Security (AWS, Azure, GCP)
07
ICS / SCADA Industrial Systems
08
Azure OpenShift / Kubernetes Security Review
09
E-Commerce and SaaS Platforms
10
Vulnerability Remediation Testing (Retest)
We follow published standards, Not a House Checklist.
From first call to signed off fix.
Six stages. You always know which one you are in. Nothing is tested without your sign off.
Scoping and rules of engagement
We agree targets, testing windows, contacts and what stays off limits. You have it in writing before anything is touched.
Week 0
Reconnaissance and mapping
We build the attack surface from the outside. Domains, hosts, technologies, leaked credentials and anything added without IT knowing.
Days 1–2
Manual testing and exploitation
Testers work by hand inside the agreed scope, joining small issues into the paths that matter. Anything critical is reported the day it is confirmed.
Days 3–7
Impact analysis
Each proven finding is rated on reach, business impact and effort to fix, so the order of work is defensible.
Day 8
Reporting and walkthrough
You get the technical report and the board summary, then a live session with the team doing the work.
Days 9–10
Retest and clearance letter
Once the fixes are in we retest every finding and issue a clearance letter for auditors, insurers or clients.
Within 90 days
In their words.
"Sadiq at AWJ Tech is an effective business partner. Throughout SHUAA's rapid business growth, he ensured world-class technology services in spite of constraints on available budget and headcount. He anticipates issues well in advance and provides timely recommendations. He has proven himself capable of rapid workarounds when the optimal best practice approach is not possible due to time, cost, and manpower limitations. "
– Stephen Stanton
SHUAA Capital (UAE)
"I have had the privilege of working with Sadiq Muhammad (from AWJ Tech). Sadiq's role as a Security leader whose expertise, vision, and leadership qualities resulted in the significant strengthening of our organisation's security posture. The team possesses expert security skills, broad and deep industry knowledge and in-depth understanding of regulatory requirements within the finance industry…”
– Ian Anderson
Hostplus (Australia)
"Sadiq is a dedicated, hard-working and thorough IT professional. He was proactive and well liked by our customers due to his 'can do' attitude. He plans and completes work without waiting to be prompted to do so. When faced with problems, proactively suggests solutions. Takes actions and decisions as appropriate to the business."
– Vijay C.
Emirates Airlines (UAE)
What clients ask us on every scoping call.
No. Denial of service is excluded unless you ask for it and sign it off. Testing windows are agreed in advance and we keep a contact reachable throughout. Anything that could affect availability is confirmed with you before it runs.
A vulnerability assessment is broad and mostly automated. It lists everything that looks weak. A penetration test is manual and narrow. A tester uses those weaknesses to show what an attacker could really do. Most companies need both. The assessment gives coverage, the test gives certainty.
It depends on the model. Black box testing needs almost nothing. Grey box testing needs a set of standard user credentials and returns more value for the same budget, which is why we usually recommend it. We will explain the trade off when we scope.
Yes, within the provider's rules. AWS, Azure and Google all allow you to test your own resources, and we handle any notice they require. Infrastructure that belongs to the provider stays out of scope.
In almost every case, yes. Our reports and clearance letters are written to support ISO 27001, PCI DSS 4.0 and NESA. We are happy to speak to your auditor or your client's security team if they need more detail.
You hear from us the same day. Critical findings go straight to your named contact with enough detail to contain the issue. We do not sit on an active risk until report day.