Recently, I was able to downgrade my iOS 8.4.1 to 8.4 and jailbreak. However, as you alluded to, this is no longer possible especially without the SHSH blobs.
There are ways to perform a security assessment on a jailed iOS device. The method was first detailed here -- http://forum.unity3d.com/threads/urgent-mac-app-review-team-rejected-because-gamekit-framework-linked.261354/
but further elaboration to modern mobile app penetration testing needs was discussed by Carl Livitt on the Bishop Fox blog in a two-part series:
You will find that some services, such as IBM's BlueMix AppScan Mobile Analyzer for iOS, will perform similar (but perhaps not the same) assessments using jailed iOS devices.
Once you have enabled use of Cydia Substrate (or cycript), it shouldn't be much of a challenge to get the standard Theos, Logos, idb, and Frida tools working. You can read more about Theos and Logos (and associated infrastructure) in the "Tweak Development Using Theos and Logos" subsection of the Mobile Application Hacker's Handbook, as well as Frida and Cydia Substrate in its section on "Attacking the iOS Runtime". More information on idb can be found in the book, "Learning iOS Forensics". Hooking some functions that accept a variety of arguments can be an additional challenge, but there is some concept code capable of hooking variadic functions.