Services / Penetration testing
Penetration testing
We attack your web applications, APIs and infrastructure the way a real attacker would — controlled and with your permission.
A penetration test shows what an attacker can actually achieve. We combine tooling with manual testing, so we also find what scanners miss: broken authorisation, flawed business logic and chains of small issues that add up to a serious risk.
What we look at
Web applications & APIs
Customer portals, web shops, SaaS platforms and the APIs behind them. Tested following the OWASP Web Security Testing Guide.
External infrastructure
Everything reachable from the internet: VPN, mail, remote access, forgotten test environments.
Internal network & Active Directory
What can an attacker do once inside — via phishing or an infected laptop — and how fast do they become domain admin?
Mobile apps
iOS and Android apps, including how they talk to your back end.
What you get
- Management summary in plain language
- Technical findings with reproduction steps, risk rating (CVSS) and concrete remediation advice
- Debrief session with your team
- Retest to confirm the fixes work
A good fit for
- Before launching a new application or major release
- When customers, auditors or insurers ask for a pentest report
- To support ISO 27001 or NIS2 controls
- Annually, to keep your security up to date
Questions
Not sure this is the right service?
Start with the Security Posture Assessment, or book a call.
Where do I start? →Black box, grey box or white box?
We usually recommend grey box: we get test accounts and some documentation. That way the time goes into finding real issues rather than guessing.
Do you test in production?
Preferably on an acceptance environment that mirrors production. If production testing is needed, we agree time windows and boundaries upfront.
How long does a pentest take?
Depending on scope, typically 3 to 10 working days. After a short intake you get a fixed price.
Curious how an attacker sees your organisation?
Book a no-obligation 30-minute call. We’ll discuss your situation and give honest advice on what makes sense — even if that isn’t work for us.