Overview
Desktop applications remain common in US banking, insurance, healthcare and manufacturing, from trading tools to clinical and plant-floor software, and they are often older than the controls around them. We test local storage, network traffic, update mechanisms and privilege boundaries, and explain fixes your developers or vendor can act on.
Thick client applications — trading terminals, ERP clients, healthcare systems, point-of-sale and internal tools — often hold sensitive data and talk directly to databases or backend services. Because they run on the user's machine, attackers can inspect, modify and replay everything the client does.
Our testers analyze the application binary and its local files, intercept and manipulate traffic (including non-HTTP protocols), inspect memory for secrets, test for DLL hijacking and insecure update mechanisms, and attack the backend services the client depends on.
The most serious issues are usually trust problems: business rules enforced only in the client, credentials or connection strings stored locally, and servers that accept whatever the client sends.
How testing works for US organizations
- Signed scope and written authorization before any testing, including hosting and cloud provider permissions
- Testing windows agreed around your US time zone at scoping, including after-hours windows for production
- Fully remote delivery, with internal and wireless access via VPN or a shipped test device, so no travel costs
- Reports mapped to SOC 2, PCI DSS, HIPAA and customer questionnaires, with a fixed price in USD
What's included
Our approach
- UnderstandArchitecture, roles and backend dependencies.
- AnalyzeStatic and dynamic analysis of the client.
- InterceptTraffic interception and manipulation.
- Attack backendTest servers and databases the client uses.
- Report & retestFindings with fixes for client and server teams.
What you receive
- Client and server findings
- Proof-of-concept evidence
- Architecture-level recommendations
- Retest report
- Attestation letter
Standards & frameworks
- OWASP Desktop App Security Top 10
- OWASP ASVS
- CWE
- PTES
- SOC 2 CC4.1
Frequently asked questions
What is a thick client?
A desktop application that performs significant processing locally and communicates with backend servers, as opposed to a browser-based thin client.
Do you need a test environment?
Yes, ideally a test instance of the client and backend with test accounts for each role.
Can you test proprietary protocols?
Yes. We analyze and manipulate non-HTTP traffic where needed.
Are you a PCI QSA or ASV, FedRAMP 3PAO or CMMC C3PAO?
No. We don't claim any of those statuses on this site. Most penetration tests for SOC 2, HIPAA, PCI DSS Requirement 11.4, the FTC Safeguards Rule and customer due diligence don't require them. If your contract, assessor or program requires a specific accredited provider, tell us at scoping and we'll say plainly whether we can meet it. See US compliance requirements.
Do you quote in US dollars?
Yes. US proposals are fixed-price and quoted in USD, with scope, effort, deliverables and payment terms set out in writing before work starts. See our US pricing guide for published market ranges.