Service 01 · Booking now
Penetration Testing
A person, working under written authorization, breaking into what you rely on — then telling you exactly how.
We test by hand. A scanner is where we start, not what we sell.
What we test
01
Web & API
Authentication, session handling, access control between roles and tenants, injection, business-logic abuse. Tested as every role you have.
02
External network
Everything of yours facing the internet: exposed services, forgotten hosts, remote access, patch state, credentials already in breach data.
03
Internal network
What happens after the first foothold: privilege escalation, lateral movement, Active Directory paths, credential reuse.
04
Cloud
Identity and permissions across AWS, Azure or GCP: over-broad roles, public storage, key handling, and the logging you would need afterwards.
05
Wireless & social
Wireless authentication, guest-network separation, and authorized phishing. Always agreed in writing, never a surprise to leadership.
Five phases
Systems, window, escalation contact, price. You sign first.
We enumerate what is really there — usually more than the asset list says.
Manual exploitation and chaining, evidence captured as we go.
Summary for the board, detail for the engineers, a fix order for both.
We verify the fixes and issue a closure letter.
What you receive
Four documents, delivered encrypted. All written to be forwarded.
Executive summary
Two pages, no jargon. What we found, what it would cost you, what to fix first.
Technical findings
CVSS v4.0, business impact, evidence, and steps a developer can follow without calling us.
Remediation plan
The fix order we would follow ourselves: this week, this quarter, structural.
Attestation letter
One page confirming the test happened and the findings closed. What insurers ask for.
Asked first
Will this take our systems down?
Anything with real disruption risk is excluded in the scope or run in a window you choose. Denial-of-service testing never happens unless you ask for it in writing.
Do you need production?
Staging is fine when it genuinely mirrors production. Where it does not, we will tell you which findings you are giving up.
Is a scan the same thing?
No. A scan lists known-vulnerable versions. A test chains what a scanner cannot see — a logic flaw in checkout, access control between two of your customers — and proves the consequence.
How often should we test?
Annually as a floor, and after any material change: new authentication, a migration, an acquisition.
What happens to our data?
Evidence is stored encrypted and destroyed on the schedule in your contract. We sign your NDA before the first call and name no client without written permission.
We are small. Worth it?
Often more than for a large company, because a small team has no margin for an incident. Scope can narrow to the one system that would hurt most.
Start with a scope call.
Twenty minutes, no charge, no obligation.