Penetration testing
Find the weaknesses in your applications and infrastructure, and learn what each one would let an attacker do.
What it answers.
- What weaknesses exist in this application or network right now?
- How far could an attacker get from each one?
- What should we fix first?
What is in scope.
Web, API, mobile, cloud, internal and external infrastructure, operational technology and hardware. Remote, on site or in our lab, as agreed. The exact boundary is written into the authorization before work starts.
- Web applications and APIs, with authenticated and unauthenticated testing
- Mobile applications and the services behind them
- Cloud configuration and identity in the accounts you name
- External and internal network infrastructure
- Operational technology, embedded devices and radio interfaces, on site or in our own lab
- Retesting of fixed findings within the agreed window
How it runs.
-
Scope
We agree targets, test accounts, testing windows and anything off limits.
-
Test
Manual testing supported by tooling, with critical issues reported as soon as they are confirmed.
-
Validate
Each finding is reproduced and its impact demonstrated safely.
-
Report and retest
You receive the report, fix what matters and we confirm the fixes.
What you receive.
- A report of validated findings, each with severity, evidence and impact
- Remediation guidance in priority order
- An executive summary for non-technical readers
- A retest letter confirming which findings are closed
What we need from you.
- The target list and a technical contact for each
- Test accounts at the roles you want covered
- Testing windows and any systems that must not be disrupted
Choose penetration testing when you have a defined set of systems and need to find and fix as many weaknesses in them as possible.
Send us the systems you want tested.
Write from your organization's email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.