Understand the risks in the desktop applications your business relies on
Desktop application reviews that test thick-client software, from bespoke line-of-business tools to third-party packages.
Trusted by companies of all shapes and sizes
What is a desktop application review?
A desktop application review tests software installed on workstations and servers, often called thick-client testing. It looks at how the application stores data locally, how it communicates with servers, and whether a user could abuse it to gain access they should not have.
Our testers examine the application on the device and across the network, covering local files and registry settings, update mechanisms, authentication and communication with back-end services. Results are reported in the Rootshell Platform with clear severity ratings and remediation advice.
The benefits of desktop application review for your business
Test the software your staff use every day, including tools that may never have been security tested.
Identify potential vulnerabilities
Find weaknesses in local data storage, insecure communication, weak authentication and unsafe privilege handling.
Proactive defence
Test business-critical tools, including older bespoke software, before someone else finds the weaknesses.
Prepare for misuse
Understand how a malicious user or malware could misuse the application, and plan your response accordingly.
Better visibility and control
Track findings, owners and fixes in one place, prioritised by severity and by the importance of the affected asset.
Stay compliant
Provide evidence that business-critical applications have been independently tested.
Stay ahead of threats with our desktop application review
Get Started
On-demand desktop application results at the click of a button
The Rootshell Platform is a neutral, centralised hub for managing vulnerabilities and protecting against threats, providing you with a single source of cyber security truth.
Recognised industry leader in penetration testing as a service (PTaaS)
Comprehensive desktop application review tailored to your needs
Elevate your security with a customisable, all-in-one solution tailored to your unique objectives, risk appetite, and budget.
Build your package:
- Penetration Tests
- Managed Vulnerability Scanning (MVS)
- Attack Surface Management (ASM)
- Red Team Assessments
- We help you choose the services that best fit your needs
- Solutions tailored to meet your team’s objectives, risk appetite, and budget
Plus receive your results an data through The Rootshell Platform
Ready to get started?
Discover your needs
Dive into a personalised demo
Seamless onboarding
Reasons to work with us
For desktop application review, Rootshell combines accredited testers with the Rootshell Platform, so every finding is easy to track and fix.
All your results in one place
Findings, retests and fixes sit in the Rootshell Platform alongside your other testing and scanner results, so progress is easy to track.
Accredited, experienced testers
Delivered by experienced testers. Rootshell is CREST registered, Cyber Scheme accredited, ISO 27001 certified, an IASME Cyber Essentials Plus certification body, and NCSC CHECK scheme accredited.
Recognised standards
Testing draws on recognised application security guidance, such as the OWASP Desktop App Security Top 10.
Clear reports, clear next steps
Clear, prioritised findings with practical fix advice, and retesting to confirm that fixes have worked.
How we deliver it
Scope, access and timing are agreed with you before testing starts, and delivery can be remote or on site where the test allows.
Talk to our team about desktop application review
Book a demo
Don’t just take our word for it, hear what our customers think
Desktop application review compared with web application testing
| Desktop application review | Web application testing | |
|---|---|---|
| Where the app runs | On user machines | On a web server, in the browser |
| What we examine | Local files, settings, memory, update process and network traffic | Pages, forms, sessions and APIs |
| Typical risks | Stored credentials, weak update checks, insecure local data | Injection, broken access control, session flaws |
| Used together | Often needed when the desktop app talks to a back end | Covers the server side the app relies on |
Common questions about desktop application review
What is a desktop application review?
It is a security assessment of software installed on a computer, often called a thick client. We look at how it stores data, how it talks to servers and how it can be tampered with.
What does it cover?
Local storage and configuration, memory handling, installers and updates, network traffic, and the back-end services the app uses.
Do you need an installed copy?
We need a working copy of the application and a test account, set up as part of scoping.
Can it be combined with other tests?
Yes. Many clients pair it with web application or infrastructure testing, so the whole path is covered.
Last reviewed: 5 November 2026. Written and reviewed by the Rootshell R&D team. Rootshell was founded six years ago and is founder-led, drawing on more than 30 years of industry experience from previous successful businesses. We deliver thousands of testing days every year. CREST registered, Cyber Scheme accredited, ISO 27001 certified, an IASME Cyber Essentials Plus certification body, and NCSC CHECK scheme accredited.
Related testing services
Most clients combine more than one test. These pair well with desktop application review.
