Penetration Testing
Through a Hacker's Eyes
We do not rely solely on automated scanners. Our experts, with years of experience in offensive security, carry out manual, controlled attacks on your infrastructure, applications and systems, finding what machines cannot detect.
- Compliance with OWASP, PTES, OSSTMM methodologies
- No false positives
- Clear remediation instructions for developers
What exactly do we test?
Our scope of work covers the entire attack surface. We tailor scenarios individually to the technology you use.
Web Applications and APIs
We detect vulnerabilities from the OWASP Top 10 (including SQL Injection, XSS, SSRF, BOLA). We test customer portals, e-commerce systems, CRMs and complex environments based on microservices and APIs (REST, GraphQL).
See detailsMobile Applications
Reverse engineering of iOS and Android applications (including Flutter and React Native). We verify secure on-device data storage, correct server communication and flaws in authorization logic.
See detailsInternal Infrastructure
We simulate an attack, for example from the perspective of a malicious employee or a compromised workstation. We examine network segmentation (VLAN), Active Directory, file servers and password policies.
See detailsExternal Infrastructure
We attack internet-facing systems and services. We verify firewall configurations, VPN server vulnerabilities, outdated software versions and DNS misconfigurations.
See detailsCloud Environments
We verify the security of resources in AWS, Azure and Google Cloud Platform. We focus on IAM permission errors, storage bucket (S3) leaks and Serverless vulnerabilities.
See detailsWireless Networks
We analyze the security of corporate Wi-Fi networks, guest network isolation, susceptibility to password interception, Evil Twin attacks and Rogue Access Points.
See detailsYour test is run by a certified pentester, not by someone starting a scanner. OSCP and OSWE are hands-on exams: you break into an environment within a time limit and document how.
Types of penetration tests: black box, grey box and white box
Penetration tests are usually split into three types: black box, grey box and white box. They differ in how much we know about the system before we start. We may get just your company name, test accounts, or the code and configuration as well. That decides how long the pentest takes and what it can cover.
Black box: no prior knowledge
We know what an outside attacker knows. This test shows what can be done with no access at all. For external infrastructure your company name and domains are enough, and we work out the rest ourselves. Mobile apps are tested this way by default, on the finished APK and IPA.
Grey box: with a user account
We get test accounts and a description of the roles, so we see the system the way your customer or employee does. This is how we test web applications: without two accounts per role we cannot check whether user A can see the data of user B. Internal network tests also usually start from an ordinary employee account.
White box: with access to code and configuration
On top of the accounts we get the source code, the API documentation or a read-only account for the configuration. The test then takes less time or goes deeper, and the root cause of a flaw is easier to confirm.
The types can be combined. In the cloud we review the configuration from a read-only account and check privilege escalation paths from an account with typical user permissions. The methodology does not depend on the type: applications follow OWASP (WSTG, ASVS, MASTG), networks and infrastructure follow PTES and OSSTMM.
Our testing process
We work methodically. We do not use a single scanner to generate a 1,000-page report full of errors. We build realistic attack chains to prove the actual risk.
Reconnaissance (OSINT)
Passive gathering of information from public sources, searching for leaks and mapping the infrastructure.
Scanning and Identification
Active port scanning, detection of services, the technologies used and software versions.
Exploitation
The core of the testing. An attempt to exploit the discovered vulnerabilities in a way that is safe for business continuity. Bypassing protections, taking over accounts, exfiltrating data.
Reporting and Retests
A detailed description of vulnerabilities with remediation instructions. After your team implements the fixes, we verify their correctness for free (retests).
What will you receive after the test?
Business Report (Management Summary)
An understandable summary of the security level dedicated to management (C-level). It presents risks in financial, reputational and operational contexts.
Technical Report
Detailed documentation with a step-by-step Proof of Concept (PoC). For each vulnerability we include ready remediation instructions recommending specific code changes (e.g. examples in Java, PHP, C#).
Security Certificate
After the successful patching of vulnerabilities and passing the retests, you will receive a certificate confirming that a thorough penetration test was carried out. Useful for business partners and auditors (ISO 27001).
Questions about penetration testing
How much does a penetration test cost?
The price depends on the scope: how many applications, user roles, IP addresses or cloud accounts we need to test. After a free consultation we email you the scope of work and a price range within two business days.
How long does a penetration test take?
Usually 3 to 15 working days, depending on the scope. We test a Wi-Fi network in 3-7 days, external infrastructure in 4-10, internal infrastructure and a cloud environment in 5-12, a web application with its API in 5-15, and a mobile application in 7-15 days.
How does a penetration test differ from a vulnerability scan?
A scanner only compares your systems with a list of known flaws and leaves a report full of alerts to check, while a pentester actually tries to exploit the flaws. The pentester chains them into an attack, for example from a weak password to an administrator account takeover. This shows which vulnerabilities really threaten your company, with no false positives.
Can a penetration test disrupt business operations?
We plan it so that your systems keep running. We do not run denial of service attacks or performance tests. Any action that could stop something is agreed with you before we carry it out, and critical systems can be excluded from the scope. We stay reachable by phone throughout the test.
What do I get after a penetration test?
Two reports. The management summary describes risk in financial, reputational and operational terms. The technical report gives a step-by-step proof of concept (PoC) and remediation instructions for every vulnerability. After your fixes we retest for free, and once the flaws are closed we issue a certificate of the completed test for business partners and your ISO 27001 auditor.
How often should you run a penetration test?
Usually once a year and after every major change, for example after deploying a new application or setting up a new server. If you push changes to production often, ask about DA1MON: subscription-based testing in which a swarm of AI agents looks for flaws and a PWNONE pentester confirms every finding.
When should you choose an attack simulation instead of a penetration test?
Choose an attack simulation when you already have a SOC or a security team and want to check whether it spots a real attack. A penetration test looks for vulnerabilities in a defined scope, and your team usually knows about it. An attack simulation (red teaming) recreates an entire attack without warning the defense.