Products
TRAIODerScannerSonatypeHashiCorp VaultDPA FASTBurp DASTBurp ProfessionalDevSecOps services by TRIDS
Services
DevSecOps implementationApplication security assessmentAppSec & DevSecOps training
Company
About usCareers & internshipsAppSecFestSonatype User GroupPrivacy policyBlogContacts
Language
RUKZEN
+7 777 734 7070 Get a consultation
Home/Services
Service

Application Security Assessment and Security Audit

We check applications for vulnerabilities and undeclared capabilities (backdoors). For companies in Kazakhstan and Central Asia — from fintech to the public sector.

Order an assessment
Scope

Applications of all types and purposes

The assessment can cover applications of any type and purpose.

Web applications and APIs

Customer portals, internet banking, REST and GraphQL APIs.

Mobile applications

Android and iOS: from source code to the store build.

Desktop and binary code

Including legacy applications without source code.

Banking and business systems

Critical systems subject to regulatory requirements.

Methods

How we analyze

The assessment uses SAST, DAST and SCA scanning, as well as container scanning.

SAST

Static analysis of source and binary code: SQL injection, XSS, insecure cryptography, hardcoded secrets, undeclared capabilities (backdoors).

DAST

Dynamic testing of a running application from an attacker's perspective.

SCA

Vulnerable and malicious open-source libraries, license risks, SBOM.

Containers

Vulnerabilities in container images and their dependencies.

  • A report listing vulnerabilities, severity ratings and supporting evidence
  • Remediation recommendations for developers
  • Re-testing after fixes
  • Confidentiality: NDA and work inside your perimeter — see our policy
FAQ

Questions about security assessment

What are undeclared capabilities (backdoors)?
Undeclared capabilities are program functions not described in the documentation, such as backdoors, hidden accounts and debugging mechanisms. Searching for them is essential for critical and banking systems.
Do you need access to the source code?
Not necessarily. Without source code we apply binary analysis and DAST; with source code we add SAST and SCA, which gives a more complete picture.
Where is our code stored during the assessment?
The assessment can be run inside your perimeter, using a tool deployed on your infrastructure. All data is protected under our privacy policy, and our staff sign NDAs.
How much does a security assessment cost?
Cost depends on the number and size of applications, their type and the depth of testing. Submit a request and we will assess the scope and prepare a proposal.
Blog

Related articles

Answers to the questions teams ask before choosing and implementing a solution.

Regulation
Kazakhstan Bank Information Security Requirements: What They Mean for AppSec

ARDFM resolutions No. 53 and No. 81 of 2026 set information security rules for Kazakhstan banks. What they mean for AppSec, SAST, SCA and secure development.

KazakhstanRead
Regulation
Kyrgyzstan Financial Sector Information Security Requirements: What to Consider in AppSec

NBKR information security rules for Kyrgyz commercial banks, the Digital Code and the Cybersecurity Law: what regulators require and what it means for AppSec.

KyrgyzstanRead
Regulation
Uzbekistan Information Security and Personal Data Requirements: What to Consider in Development and AppSec Procurement

Uzbekistan personal data law No. ZRU-547 after 2026 amendments and CBU regulation No. 19/1 for banks: localization, secure development and AppSec procurement.

UzbekistanRead
Consultation

We protect your applications at every stage of development.

Tell us about your challenge — AST Cyber Lab experts will select a solution, run a demo and help with implementation.

Get a consultation +7 777 734 7070