Penetration testing
Penetration testing by certified testers
We test your applications and infrastructure the way a determined attacker would, by hand rather than by scanner alone. You learn which weaknesses actually matter, how serious each one is, and how to fix it.
Users can view other customers' order history
Check record ownership on the server for every request, not only in the user interface.
Coverage
What we test
We agree the exact scope with you on the scoping call. These are the areas we typically cover.
Web applications
- Login, sessions and password reset
- Access control between users and roles
- Input handling and data validation
- Business logic and payment flows
External network
- Internet-facing servers and services
- VPN and remote-access gateways
- Email and DNS configuration
- Forgotten or unlisted assets
Internal network
- Active Directory configuration
- Network segmentation
- Privilege and access hygiene
- Workstation and server hardening
Cloud
- AWS, Azure and Google Cloud accounts
- Identity and access policies
- Storage and database exposure
- Containers and Kubernetes
Deliverables
What you receive
- Executive summary written for leadership
- Detailed findings with severity, evidence and fix
- Risk-ranked remediation plan
- Free retest of fixed issues
- Testing attestation letter for customers and auditors
Aligned to PTES · OWASP WSTG · NIST SP 800-115
Is it right for you?
Choose this if…
- You're launching a new product or major release
- A customer or investor has asked for a pentest report
- You need evidence for ISO 27001, SOC 2 or PCI DSS
- You haven't had an independent test in the last 12 months
Testing approach
Black, grey or white box
How much we know at the start changes what we can cover in the time available.
Black box
We start with only your domain or IP addresses, like an outside attacker. Best for testing your external exposure.
Grey box
We get user accounts for each role. This gives the best coverage for the budget and is our usual recommendation.
White box
We also get documentation, architecture diagrams or source code. Gives the deepest assurance for high-risk systems.
Process
How the engagement runs
Scope
A 30-minute call to agree on targets, testing windows and rules of engagement. You get a fixed quote.
Map
We map what's in scope: features, user roles, integrations, and anything exposed that wasn't on the list.
Test
Hands-on testing by certified testers. Critical issues are reported to you straight away.
Report
A summary for leadership, plus a detailed finding for each issue with evidence and a specific fix.
Retest
We verify your fixes and issue an updated report and attestation letter.
FAQ
Penetration testing: common questions
How long does a penetration test take?
Most web application tests take one to three weeks, depending on the number of user roles, features and integrations. We confirm the timeline in the quote.
Will testing affect our live systems?
We agree testing windows and limits with you before we start, and we avoid anything that could disrupt service. Many clients choose to test a staging environment that mirrors production.
What's the difference between black, grey and white box?
It's how much we know going in. Black box means we start with nothing, grey box means we have user accounts, and white box means we also see documentation or code. Grey box gives the best coverage for the money in most cases.
Do you provide a certificate?
Yes. After the retest we issue an attestation letter confirming the scope, dates and outcome, which you can share with customers and auditors.
Related
Often combined with
Vulnerability assessment
A broad, verified sweep of your infrastructure for known weaknesses and missing patches.
CVSS 3.1 / 4.0 · NIST SP 800-115 Learn moreAPI security testing
In-depth testing of REST, GraphQL and gRPC APIs, covering access control, authentication and business logic.
OWASP API Security Top 10 Learn moreMobile security testing
Android and iOS app testing, including the backend APIs each app depends on.
OWASP MASVS · MASTG Learn moreFind out where you're exposed before an attacker does.
Tell us what you need tested. We'll reply within one business day with questions or a fixed quote.