Thick-Client Penetration Testing
A thick-client penetration test covers the parts a web-app test never reaches — local data storage, offline authentication logic, inter-process communication, and the compiled binary itself — alongside the network and API calls a desktop or hybrid client makes.
What we test
A thick-client engagement treats the installed application as part of the attack surface, not just the server it talks to.
Client-side storage & config
Local databases, cached files, and configuration data reviewed for secrets or sensitive data stored in the clear.
Authentication & session handling
How the client authenticates, holds a session, and behaves offline — including logic that never touches the network.
Local privilege & sandbox escape
Whether the client can be coerced into running with more access than it should have, on the machine it's installed on.
Network & API calls
Every call the client makes outward — endpoints, headers, and data — reviewed alongside the client itself, not in isolation.
Update & patch mechanism integrity
Whether the update path can be tampered with to deliver something other than what the vendor intended.
Who this is for
Software vendors shipping a desktop client
Teams building a Windows, macOS, or Linux application that stores or processes sensitive data locally.
Hybrid and native mobile clients
Apps with local storage or offline authentication logic follow the same review approach as a desktop client.
Pre-release or due-diligence review
A security review ahead of a release, or evidence to satisfy a customer's due-diligence requirement before they'll sign.
Frequently asked questions
A web-app test mostly stops at the browser boundary. A thick-client test goes further: local data storage and config files, inter-process communication, offline authentication logic, and the compiled binary itself are all in scope, alongside whatever network or API calls the client makes.
It depends on the size of the application and how much of it is in scope — client, API, or both. We size the engagement after a short scoping conversation rather than quoting a fixed timeline upfront.
Yes. Native and hybrid mobile apps that store data or handle authentication locally follow the same testing approach as a desktop thick client — get in touch and we'll confirm scope for your platform.
A written report of what was tested, what was found, and how severe each finding is — written so both an engineer and a non-technical stakeholder can act on it.
Tell us about your application
Get in touch to discuss your application and we'll scope the engagement with you.
Get in touch to discuss scope