About AppSec Labs

Who we are

Specialists, not generalists

What we do

Deep, manual penetration testing of web applications, REST APIs and mobile apps, including the AI and LLM features increasingly built into them. We look for the flaws that matter in a real system: broken authorization, tenant isolation failures, business-logic and workflow abuse, and chains of small issues that together become serious. Every reported finding is retested after your developers have fixed it.

How we work

Human-led testing, accelerated by our own platform, CybeRapid, which takes the repetitive work out of an engagement so more of our testers’ time goes on judgement: attack strategy, business context, and what actually matters to you. Reports are written for the engineers who have to fix the problem — reproduction steps, real impact and a concrete remediation, and we will defend any finding to the developers who wrote the code.

What we won’t do

We will not pad a report to look thorough, and we will tell you when a finding is not exploitable rather than bank the severity. We do not sell tools, training or managed services, and we will say so when a test is not what you need yet. A penetration test is only worth buying if you can act on the result.

Our people

A small team of specialists

We hire for depth rather than headcount. People who have worked here have gone on to write tools the industry depends on and to found companies acquired by Snyk, Check Point, Contrast Security and Zimperium — that story is on our alumni page.

The company was founded in 2010 by Erez Metula, in the same year Syngress published his book on attacking managed runtimes. More about our founder.