Executive Summary
Summarizes the issues found in the application's source code and any implementation errors, and assesses the overall level of security.
Code Review (CR)
Specialist services to protect your business
Code Review (CR)
A Code Review process has the aim to identify vulnerabilities in the source code. It represents one of the most important phases in the development of a safe application, allowing to identify many security issues before the software has gone in production. This process markedly reduces risk and costs
Code Reviews are characterized by an high degree of complexity, so it is fundamental that the auditor has a solid understanding of safe programming, general design, major attack typologies and that has a superior confidence in code reading and understanding.
The Code Review service offered by ISGroup is carried out by a team of professionals who have years of successful development and auditing experiences.
ISGroup is the ideal provider for your Code Review needs and acts with seriouness according to internationally recognized standards at the highest quality levels thanks to a steady commitment in the research area. Contact us to request a personalized preventivo.
Description
The process is fundamentally composed by two phases, in the initial one the whole application is examined using one or more static analysis tools. Such tools have the purpose to simulate the code execution and to identify the eventual vulnerabilities. This approach has substantial advantages compared to testing the application alone, as there is a fully awareness of the application behavior.
In the following phase the code is manually analyzed concentrating on the most significant and exposed parts of the application. The analysis is executed by an heterogeneous team of highly qualified auditors to spot even the most complex and less-obvious vulnerabilities.
This second phase is mandatory: automatic tools are unable to correctly identify some vulnerabilities because of the intrinsic complexity of the task.
The Report
You will receive a clear, detailed document divided into three areas.
Technical Details
For each issue, indicates the affected section of the source code, a detailed explanation of the problem and its solution (Remediation).
Remediation Plan
Prioritizes the recommended fixes by risk (critical, high, medium, low) and Effort to Remediate (high, medium, low).
Manual Secure Code Review
Specialists analyze business logic, access controls, and flows that require application context.
Hybrid Secure Code Review
Combines static analysis, manual validation of findings, and review of the most critical code.
AI-Assisted Code Review
Uses AI to examine the code and a specialist to validate the security findings.
Show your commitment
At the end of the Code Review you receive a signed document, in Italian and English, stating activity, period and scope. Unlike the report, it contains no vulnerabilities or technical details: you can hand it to anyone who asks for it without exposing yourself. It is included in the service.
Certificate of execution
IT / EN
- Client
- Activity
- Period
- Scope
ISGroup
Code Review
and compliance
PCI DSS
Identifies defects in payment application code and supports the secure development practices required by PCI DSS Requirement 6.2.4.
CRA
Detects software weaknesses before release and supports the development and vulnerability management required by CRA Annex I.
NIS2
Examines code and identifies application vulnerabilities, supporting security in system development and maintenance under NIS2 Article 21(2)(e).
GDPR
Checks personal data controls and protections in code, providing input for data protection by design under GDPR Article 25.
DORA
Analyses financial application code and documents weaknesses relevant to the security of systems and protocols under DORA Article 9.
OWASP ASVS
Compares application controls and code logic with verifiable authentication, authorisation, validation and data protection requirements defined by OWASP ASVS.
Frequently asked questions about
Secure Code Review
What is a Secure Code Review and what does it analyse?
A Secure Code Review is a security analysis of an application's source code. ISGroup combines static analysis tools (SAST) with manual review of flows, controls, authorisation and business logic, on the code and critical components agreed in the proposal.
What is the difference between a Code Review and a penetration test?
A Code Review examines the source code, whereas a penetration test checks the behaviour and exposed surfaces of the running application. For web applications the dedicated service is the Web Application Penetration Test; for iOS and Android apps it is Mobile Application Security Testing.
What do we need to provide to start the Code Review?
To start the Code Review, ISGroup needs the source code, delivered through a secure digital channel and, when the analysis tools require it, as a buildable project.
How much does a Code Review cost and how long does it take?
The cost of a Code Review depends on the chosen mode: hybrid review with tools and manual analysis, Best Effort, or effort sized on the number of source lines of code (SLOC). Price and duration are stated in the proposal once the scope has been defined. A free 30-minute consultation is available to clarify repositories, languages and objectives before the proposal.
What does the Code Review report contain?
The Code Review report includes an Executive Summary for management, Technical Details with the affected code, explanation and fix for each issue, and a Remediation Plan prioritized by risk and Effort to Remediate. You also receive a signed Certificate of execution. It contains no vulnerability or technical details and can be shared with third parties.
Where can I check ISGroup's research work?
ISGroup publishes advisories and exploits following the responsible disclosure model, coordinating publication with the vendor's release of the fix. Published advisories and CVEs are listed in the Research section.
Shape your security priorities into a tailored proposal