Web Application Penetration Testing

Fixed-fee deliverables

• Agreed authentication, sessions, authorization, business logic, data handling, and linked API attack-path checks.
• A Penetration Test Plan, Test Cases, and Test Report for the agreed attack surface and product versions.
• Documented findings, reproduction evidence, and remediation recommendations. Clean test cases and agreed retest evidence. Device tests trace to documented threats. They distinguish security impact from manufacturer-supplied patient-harm context.

Required inputs

• Application URLs and versions, user roles, test accounts, API documentation, and business workflows in scope.
• Written authorization, rules of engagement, in-scope targets and versions, test windows, and an escalation contact.
• Test accounts, environment access, architecture and data-flow information, and known access restrictions. Device work also needs intended use, available threat model, and ISO 14971 hazard context.

Exclusions and separate work

• Unlisted targets, production disruption, destructive hardware work, and third-party systems without authorization are excluded. Additional interfaces require agreement.
• SBOM generation, SAST, threat-model creation, and architecture views are separate unless explicitly bundled. A targeted test is not whole-device coverage.
• General software verification and validation, clinical performance testing, and full QMS implementation or certification are outside Blue Goat's product cybersecurity scope.
• The manufacturer retains engineering changes, clinical-risk evaluation, risk acceptance, release approval, and regulatory submission decisions. No regulatory outcome is promised.

Pricing and scope changes

A written fixed-fee quote after scoping. The proposal names deliverables, versions, assumptions, required inputs, exclusions, and agreed dates. Additional work requires a separately agreed scope change. Missing inputs, access restrictions, manufacturer fixes, and review feedback can affect delivery.