Services / Penetration Testing

Find out what an attacker would find. Before they do.

Manual, methodology-driven penetration tests by experienced testers. Clear rules of engagement, careful handling of production systems, and a report that drives remediation. Retest included.

Request a scoping call What the report contains

Scope types

Tested where your risk is.

WEB

Web applications

Portals, customer platforms and internal tools, tested against OWASP WSTG and ASVS.

API

APIs

REST and GraphQL interfaces, authentication, authorisation and business logic.

EXT

External infrastructure

Your internet-facing attack surface: services, VPN gateways, mail and DNS.

INT

Internal network & Active Directory

An assumed-breach view: lateral movement, privilege escalation and AD weaknesses.

CLOUD

Cloud environments

Configuration and identity review for Microsoft Azure, Microsoft 365, AWS and Google Cloud.

OT

OT/ICS-aware testing

Boundary and segmentation testing towards production networks, with safeguards agreed in advance.

Methodology

Structured, repeatable, documented.

Based on PTES and OWASP. Every step is logged, so results are traceable and comparable over time.

01

Scoping

Targets, test windows, contacts and rules of engagement in writing.

02

Reconnaissance

Mapping the attack surface and gathering information.

03

Testing

Manual analysis supported by tools. Controlled exploitation to prove impact.

04

Reporting

Written report and a debrief with management and technical teams.

05

Retest

We verify your fixes and confirm the status in an updated report.

The report

Readable for the board. Actionable for engineers.

Executive summary

Overall risk, key findings and business impact on two pages.

Technical findings

Each finding with evidence, affected assets and steps to reproduce.

Risk rating

CVSS-based scoring, adjusted to your environment and exposure.

Remediation guidance

Specific fixes and quick wins, prioritised by risk.

Findings overview SAMPLE

ID	Finding	Severity
F-01	Broken access control in order API	Critical
F-02	Kerberoastable service account	High
F-03	Outdated TLS configuration on VPN	Medium
F-04	Verbose error messages	Low

Illustrative excerpt. Real reports are shared only through encrypted channels.

Define the scope with a tester.

You speak with the people who will run the test. Fixed-price offer after the call.

Request a scoping call