Penetration testing
Our technical team has the skills, knowledge and experience to test your software and hardware for the security vulnerabilities an attacker would find. We don't stop at a scanner report: every finding is confirmed by hand, exploited where it's safe to do so, and explained in terms of what it would actually mean for your business.
Manual first
Automated tools find the obvious. Our testers chain small weaknesses together the way a real attacker would, and that's where the serious issues usually hide.
Safe by design
Scope, timing and rules of engagement are agreed in writing before any testing starts. Anything that could affect production is discussed with you first.
Results you can act on
Every finding comes with how we found it, how we exploited it, what it puts at risk and how to fix it, ranked so your team knows where to start.
What type of penetration test do you need?
Most engagements combine more than one of these. If you're not sure where to start, tell us what worries you most and we'll recommend a scope.
Network service tests
Network service tests find the vulnerabilities and gaps in your network infrastructure. Because networks have both internal and external access points, we test on site at your location as well as remotely from our offices.
External: we look at everything an attacker on the internet can reach (firewalls, VPNs, remote-access portals, mail and DNS servers, exposed services) and try to turn any weakness into a foothold.
Internal: we assume an attacker is already inside, through a compromised laptop, a malicious insider or a successful phishing email, and show how far they could get: moving between systems, escalating privileges and reaching your most sensitive data.
Along the way, we target areas such as:
- Firewall configuration
- Stateful analysis
- Firewall bypass
- IPS deception
- DNS-level attacks (zone transfer, switching and routing)
- Network segmentation
- Active Directory
- Privilege escalation
Web application tests
Web application tests are the most intense and detailed. Our testers examine every endpoint your users interact with day to day, along with the browsers and browser components your application depends on.
We test as an anonymous visitor and as each type of logged-in user, because many of the most damaging flaws only appear once you're authenticated: one customer reading another's data, a regular user reaching admin functions, or a workflow that can be completed out of order. We cover the APIs behind your web and mobile front ends too, since that's often where access checks are weakest.
- Authentication & sessions
- Access control
- Injection
- Business logic
- APIs
- Cryptographic failures
- File uploads
- Misconfiguration
Client-side tests
Client-side tests identify threats in the software your people run every day: SSH and Git clients, sniffers, browsers and commercial off-the-shelf (COTS) applications, which are often vulnerable when flawed.
Locally developed tools are included too. Building in-house applications on unvetted open-source components can introduce serious risk, and those tools rarely get the scrutiny that customer-facing software does. We look at how they handle untrusted input, store credentials and talk to the rest of your environment.
Wireless network tests
Wireless tests analyze the devices on your network, from laptops and tablets to smartphones, along with the protocols and access points used to configure and run your wireless setup.
We check whether someone in your parking lot could join your network, whether guest Wi-Fi is really separated from your corporate systems, and whether a fake access point could trick your staff's devices into connecting to it.
- Encryption & authentication
- Guest network isolation
- Rogue access points
- Device configuration
Cloud, ICS & IoT tests
Cloud: moving to the cloud moves the attack surface. We review how your cloud accounts are configured and test them the way an attacker would: over-permissive identities, exposed storage, leaked keys, and paths from one compromised service to the rest of your environment.
ICS & IoT: industrial control systems and connected devices are often built for reliability rather than security, and can be hard to patch. We test them carefully and with your operations team involved, so that safety and uptime always come first.
Penetration testing as a service
Your attack surface changes with every release. We provide penetration testing on a continuous or periodic basis, so new weaknesses are found while they're still cheap to fix.
A once-a-year test shows you a snapshot. Testing on a schedule that follows your development cycle catches the issues introduced since, and lets you show customers and auditors that security is checked regularly, not just once.
- Scheduled tests aligned with your release cycle
- Retesting to confirm fixes
- A consistent team that knows your environment
- Trends over time, so you can see your security improve
Penetration testing phases
Every engagement follows a proven, repeatable process, from the first piece of reconnaissance to the remediation plan.
Information gathering
We collect information from the organization being tested so we understand the targets in scope and what matters most to you.
Reconnaissance
We build on that information to find details that were overlooked, unknown or never provided. This step is critical for accurate testing.
Discovery & scanning
We identify the ports and services that can be reached on target hosts, web applications and subdomains.
Vulnerability assessment
We determine the weaknesses that would let an attacker gain access to the area being tested.
Exploitation
Using intuition and manual techniques, we confirm, attack and manipulate those vulnerabilities to show their real impact.
Analysis & report
A complete report covering the scope, techniques, how each issue was found and exploited, and our recommendations.
Remediation
The most important step: we help you use the results to set a remediation strategy, then retest to confirm the fixes.
A report written for both your executives and your developers.
A penetration test is only as useful as what you do with it afterwards, so we put as much care into the report as into the testing.
- Executive summary: the overall risk in plain language, and the handful of things to fix first.
- Detailed findings: each issue rated by severity, with evidence and step-by-step reproduction so your team can verify it themselves.
- Clear remediation: specific, practical fixes, not generic advice copied from a scanner.
- Scope and method: what was tested, how and when, which is useful for audits and compliance.
- A walk-through: we go over the results with your team and answer questions before you start fixing.
Let's scope your test.
Tell us a little about your environment and we'll come back with a scope, timeline and quote.
- A reply within one business day
- Certified team (OSCP, GPEN, GWAPT, GMOB, CRTL)
- Your details stay confidential
Social engineering tests
Social engineering tests verify the human network of your organization. People are often the easiest way in, and no amount of technology fixes that on its own. We always inform the appropriate people before an engagement begins.
The goal is never to embarrass anyone. Results are reported in aggregate, with practical recommendations for training and process changes that make the next real attempt fail.