External (perimeter)
What an attacker sees from the Internet: exposed services, VPN, email and websites.
Penetration testing
Penetration testing for businesses:types, process and what you get
A penetration test is an authorised intrusion test: we try to exploit the vulnerabilities in your website, network or applications as an attacker would, to prove the real risk and tell you in which order to fix it. It is carried out by a certified team (CEH, eJPT), with manual validation, not just scanners.
A pentest, a scan and an audit are not the same
| Vulnerability scan | Pentest | Audit | |
|---|---|---|---|
| Goal | List known flaws | Prove whether they can be exploited | Review controls and processes |
| Depth | Automated and broad | Manual and targeted | Organisational and technical |
| Result | A list of findings | Evidence, impact and priorities | A risk map and a plan |
Types of pentest we run
Internal and Active Directory
What someone already inside your network, or with a stolen account, could do.
Web application and API
Following the OWASP Top 10 and the WSTG testing guide: authentication, authorisation, injections.
Mobile application
According to the OWASP MASVS standard: storage, communications and logic.
Wi-Fi and cloud
Wireless networks and the configuration of Microsoft 365, Azure or AWS.
Social engineering
Phishing simulations and tests on people’s processes.
Black, grey or white box
Black box
No prior information, like an external attacker. It measures what can be seen from outside.
Grey box
With a user account or some documentation. The most common option for businesses.
White box
With access to the code or architecture. It finds more in less time.
A pentest from start to finish
We follow recognised methodologies (OWASP WSTG, PTES, OSSTMM and NIST SP 800-115) and map techniques to MITRE ATT&CK.
- 01
Scope and authorisation
We define what is tested, when and how, and sign the authorisation letter and the NDA.
- 02
Reconnaissance
We gather public and technical information about the target, as an attacker would.
- 03
Controlled exploitation
We try to exploit what we find without disrupting operations and stop at any risk.
- 04
Report and meeting
We deliver the results and go through them with management and the technical team.
- 05
Verification
We check that the fixes work, according to the agreed scope.
What you get
- An executive report for management: risk, impact and priorities in plain language.
- A technical report: each finding with its severity (CVSS), evidence, steps to reproduce it and how to fix it.
- A closing meeting with management and the technical team.
- Verification of the fixes according to the scope.
What the budget depends on
There is no single price: we prepare a tailored proposal based on:
- The type of test (external, internal, web, API, mobile, cloud).
- The size of the scope: number of IPs, URLs, applications or users.
- The depth (black, grey or white box) and the testing windows.
- Whether verification of the fixes is included.
How often to do it
- At least once a year and after any major change (new website, cloud migration, merger).
- NIS2 (art. 21) requires assessing the effectiveness of cybersecurity measures.
- ISO/IEC 27001:2022 requires managing technical vulnerabilities (control A.8.8).
- PCI DSS (requirement 11.4) requires regular penetration testing.
- DORA provides for threat-led penetration testing (TLPT) for significant financial entities.
Frequently asked questions about penetration testing
It should not. We agree testing windows, avoid destructive techniques and stop if anything puts a production system at risk.
Only for grey or white box tests. In black box we work without prior information, like an external attacker.
We tell you straight away, without waiting for the final report, so you can act as soon as possible.
Yes: the report is evidence that you assess the effectiveness of your measures, which NIS2, ISO 27001 and many insurers ask for.
Yes. Before starting we sign the authorisation letter and the NDA.
Want to know where an attacker would get in?
Tell us what you want to test and we will send a proposal with scope and dates.