Blog
Minnesota Water Attacks and the Predictable Reality
How possible Iran-linked actors exploited exposed PLCs in the 2026 Minnesota water attacks. MITRE ATT&CK mapping, risk matrix, and OT security lessons from Lares.
Application Security Testing
Manual testing for the applications that matter most to your business.
Lares tests web apps, APIs, mobile apps, thick clients, embedded systems, and AI-enabled workflows to expose the risks automation misses. We show you how attackers can abuse your applications and what to fix first.
Application Security
Software threats are evolving. So should your defenses.
Applications are where identity, data, and business logic meet, which is why attackers focus there. Lares brings operator-led testing to your application stack so you get a clear view of real abuse paths, not just a scanner report.
- Authenticiation & Authorization Bypasses
- Business Logic Flaws
- Insecure APIs & Integrations
- Vulnerable Third-Party Componets
- Mobile Storage & Transport Flaws
- CI/CD Pipeline Weaknesses
Our Services
End-to-end application security testing and advisory.
Web Applications
Auth, session handling, user flows, and business logic.
APIs
Auth, object-level access control, data exposure, and trust boundaries.
Mobile applications
Local storage, transport security, auth flows, and app-API interactions.
Thick clients
Desktop and client-heavy apps where local logic and secrets create risk.
Embedded and IoT
Applicaiton-layer behavior in connected devices and embedded systems.
AI-enabled applications
LLM features, agents, and AI-driven workflows; deeper AI testing via the dedicated AI service when needed.
Our AppSec Methodology
We adapt our testing approach based on your application's maturity, source code availability, and specific security objectives.
Authenticated Threat Modeling
When limited source code or user credentials are provided, we conduct a Gray Box assessment, combining elements of black-box exploitation with inside knowledge.
-
The Approach: Engineers test the application from the perspective of an authenticated user (such as a standard employee, customer, or tenant).
-
The Focus: Identifying privilege escalation paths, tenant isolation bypasses, Insecure Direct Object References (IDOR), and broken access controls.
-
The Outcome: Clear visibility into what a malicious insider or compromised user account could achieve once past the initial login screen.
True Adversarial Simulation
When source code is unavailable or you want to test your application from the perspective of an external attacker, we perform a full Black Box assessment.
-
The Approach: Our engineers attack the application with zero prior knowledge of the internal codebase or architecture, simulating a real-world threat actor.
-
The Focus: Identifying externally facing vulnerabilities, authentication bypasses, injection flaws, and business logic errors that a malicious user could exploit.
-
The Outcome: A realistic understanding of your application's external risk profile and resilience against unauthenticated attacks.
Comprehensive Code-Level Security
Having access to the source code provides the most sound and thorough approach to assessing application security during or after the development phase.
-
The Approach: A deep-dive review of the application's source code, architecture, and backend integrations, paired with targeted black-box and network testing.
-
The Focus: Uncovering deeply embedded design flaws, hardcoded credentials, insecure cryptographic implementations, and systemic vulnerabilities that external scans miss.
-
The Outcome: Complete remediation guidance at the code level, enabling your developers to build secure-by-design applications and eliminate technical debt.
Frequently Asked Questions
What types of applications do you test?
We assess web applications, APIs, mobile apps, thick clients, embedded or IoT-connected interfaces, and AI-enabled application workflows when they are in scope. The goal is to test how the full application ecosystem can actually be abused, not just how one isolated component behaves.
Is this different from a standard penetration test?
Yes. Application security testing is focused on the application layer, including user flows, authentication, authorization, APIs, data handling, and business logic. Broader penetration testing can include infrastructure, hosts, and other enterprise assets beyond the application itself.
Do you rely on scanners or perform manual testing?
We use automation where it helps, but the real value comes from manual testing performed by operators who validate impact, chain weaknesses, and test abuse paths that scanners miss. That is especially important for business logic flaws and multi-step attack paths.
Can you test web, API, and mobile components in one engagement?
Yes. If those systems work together, we can scope them together so the assessment reflects how attackers would approach the real environment. This is often the best way to uncover issues that cross trust boundaries and application layers.
Do you perform black box, grey box, and white box testing?
Yes. The right model depends on your goals, maturity, and available access. We scope the engagement around what you need to learn, whether that is external attacker realism, deeper validation, or release-focused assurance.
Can you assess AI-enabled applications too?
Yes. If your application includes LLM features, agents, or AI-driven workflows, we can test those as part of the application attack surface. For broader or deeper AI-specific validation, Lares also offers a dedicated AI Security Testing service.
What kinds of issues do you typically find?
Common findings include authentication and authorization failures, insecure API behavior, data exposure, input handling flaws, business logic abuse, and weaknesses caused by configuration or trust assumptions. In complex applications, smaller issues can often be chained into meaningful attack paths.
What do we receive at the end of the engagement?
You receive an executive summary, a technical findings report, prioritized remediation guidance, and a debrief with the testing team. Retesting can also be included when you need validation that critical fixes were completed successfully.
Can you test production environments?
Sometimes. Production testing can be appropriate when it is carefully scoped and coordinated, but many clients prefer staging or pre-production depending on risk tolerance and operational constraints.
How do we know whether we need AppSec, AI testing, or a broader red team?
If you want to validate whether a specific application or application ecosystem can be abused, AppSec is usually the right fit. If the concern is AI-specific behavior or autonomous workflows, AI testing may be the better option; if the goal is broader adversary simulation across multiple surfaces, red teaming is more appropriate.
Looking for something else?
Some of Our Delighted Customers
"The expertise and professionalism that Lares' Purple Team brings to the table are unmatched. We will definitely be bringing them back for future engagements."
SVP & CISO, Hyatt
"They wanted to see us succeed as much as we wanted to see us succeed. This is why, 10 years later, we are still having this conversation."
(Former) Chief Compliance & Security Officer, The Word & Brown Companies
"The biggest benefit of having a Lares vCISO is getting guidance on how to tackle security issues and determining a realistic approach on how to address them."
Corporate Director of Technical Services, Ulbrich Stainless Steel and Speciality Metals Inc.