Modern applications are no longer built from scratch.

Today, it is common for applications to rely on services such as Clerk or Auth0 for authentication, AWS for cloud infrastructure, GraphQL for APIs, Stripe for payments, and various third-party SaaS platforms and APIs.

These services are generally mature and have dedicated security teams. Developers can rely on security controls that would otherwise be difficult to build and maintain themselves.

So, if the underlying technologies are already well secured, how should penetration testing be approached today?

The answer is simple:

The focus of modern application penetration testing needs to shift from breaking individual components to testing how the application uses and connects them.

The Application Is No Longer Built From Scratch

A traditional application might look like:

User → Web Server → Application → Database

A modern application can look very different:

User → Frontend → Authentication Provider → API / GraphQL → Cloud Services → Database → Third-Party APIs

Each component may be secure on its own.

The challenge is making sure that security is maintained across the entire application.

This means a modern pentest needs to look beyond individual technologies and examine how the application handles identity, permissions, data and trust between different components.

Authentication Is Only the Beginning

With platforms such as Clerk and Auth0, developers no longer need to build authentication from scratch.

That’s generally a good thing.

But successfully logging in is only the beginning of a penetration test.

The more important question is:

What can the user do after logging in?

Can a normal user access another user’s information?

Can they perform an administrator function?

Can they modify another organisation’s data?

Can they directly call an API that isn’t exposed through the application’s interface?

A secure authentication provider can establish who the user is.

The application still needs to determine what that user is allowed to do.

This makes authorization testing increasingly important in modern application VAPT.

APIs and GraphQL Change the Attack Surface

Modern applications increasingly rely on APIs, while GraphQL has become common for applications that need flexible data access.

This changes how penetration testing should be performed.

A tester should not simply follow the application’s user interface.

The UI shows what the developer expects the user to do.

The API shows what the backend actually allows.

Testing should therefore include:

• BOLA / IDOR
• Privilege escalation
• Direct API access
• GraphQL queries and mutations
• Parameter and object ID manipulation
• Access to other users’ or tenants’ data
• Functions that are not exposed through the UI

The objective isn’t simply to find API endpoints.

It is to determine whether the backend properly enforces security when those endpoints are used in unintended ways.

Business Logic Becomes More Important

This is one of the biggest changes in modern application penetration testing.

Technical vulnerabilities can often be identified with automated tools.

Business logic vulnerabilities require the tester to understand how the application is supposed to work — and then deliberately break that workflow.

For example:

Submit request → Manager approval → Service activated

What happens if the user tries to approve their own request?

Or skips the approval step entirely?

Other examples include:

• Skipping verification steps
• Performing actions in the wrong order
• Reusing transactions
• Manipulating prices or quantities
• Bypassing approval workflows
• Performing privileged actions through direct API requests

These vulnerabilities are not necessarily weaknesses in the underlying technology.

They are weaknesses in how the application implements its business rules.

Third-Party Integrations Create New Trust Boundaries

Modern applications rarely operate alone.

They exchange information with identity providers, payment platforms, cloud services and other APIs.

Each integration creates a trust boundary.

The question for a penetration tester is not necessarily:

“Can I hack the third-party service?”

It is:

“What does the application trust from that service, and can that trust be abused?”

An identity provider may correctly identify a user, for example.

But the application still needs to correctly translate that identity into permissions.

This is why testing the integration between components can be just as important as testing the components themselves.

Multi-Tenancy Needs Deeper Testing

Many modern applications are SaaS platforms serving multiple customers from the same application.

This makes tenant isolation a critical area of VAPT.

A tester should ask:

Can Customer A ever access Customer B’s data?

Testing may include:

• Manipulating tenant or organisation IDs
• Accessing another tenant’s resources
• Testing API authorization across tenants
• Checking file and data isolation
• Testing whether administrative functions are correctly scoped

A single authorization flaw can potentially expose data across an entire customer base.

So, Has Your Pentest Methodology Changed?

Modern application architecture has changed significantly.

Developers now have access to mature authentication platforms, cloud infrastructure, APIs and third-party services that provide strong security controls.

That’s a positive development.

But it also means penetration testing needs to evolve.

Instead of focusing primarily on whether individual technologies can be broken, modern application VAPT should focus on:

Authorization.

APIs and GraphQL.

Business logic.

Multi-tenancy.

Third-party integrations and trust boundaries.

And ultimately:

What can an attacker do with legitimate access that the application was never designed to allow?

At Perennial Consultancy, our VAPT approach combines automated assessment with manual, attacker-minded testing. We focus on how the application actually behaves — not just whether individual security controls are present.

Because modern applications aren’t necessarily easier to hack.

They just require a different way of thinking about how to test them.

Explore our VAPT & Penetration Testing Services

If you’re a Singapore SME, you may also be eligible for the CSA-supported CISOaaS VAPT Grant, which provides funding support for eligible penetration testing engagements.