Pentesting Services
Find cybersecurity weaknesses in your digital infrastructure
A penetration test is an authorized security assessment of the systems agreed with the client. It combines technical checks and manual validation to identify exploitable weaknesses, document evidence and prioritize remediation within the defined scope and testing period.
Types of Pentesting
Black, grey and white box approaches differ in the information available before testing. For AI or LLM applications, review our AI security consulting and LLM application reviews.
Black box: testing starts with limited prior information about the agreed target. Authorization, boundaries and contact arrangements are always defined in advance.
Grey box: testing uses partial information, such as agreed user accounts, technologies, IP addresses or domains, to assess the relevant scenarios.
White box: the client provides detailed information, such as architecture, source code or configurations, according to the agreed access and review scope.
Pentesting Methodology
- Reconnaissance: Initial phase where we obtain as much information as possible about the target using different techniques.
- Identification: Identification focuses on analyzing the information collected and looking for weaknesses.
- Exploitation: In case it is possible and with the customer agreement, we proceed to exploit the vulnerabilities discovered in the identification phase.
- Reporting: document the findings observed during testing, their evidence, impact, limitations and prioritized remediation recommendations.
Who a pentest is for
A scoped penetration test is useful when you need evidence, not assumptions, about how exposed an application or system really is.
- Companies about to launch or significantly change a web application, API or customer portal.
- SMEs whose customers, partners or insurers ask for an independent security assessment.
- Teams that have already run automated scans and need manual validation of what is actually exploitable.
- Organisations preparing evidence for frameworks such as ENS, ISO 27001 or NIS2, where technical testing supports the risk analysis.
What you receive
- A written authorisation and scope document: systems, methods, limits, testing windows and contacts.
- An executive summary for management, with the overall risk and the decisions that need attention.
- A technical report with each finding, its evidence, impact, affected assets and prioritised remediation guidance.
- A findings review session with your technical team.
- An optional re-test of corrected findings, when it is included in the agreed scope.
See what a report looks like in our free sample pentesting report.
What We Test in a Pentest: Web, APIs, Cloud & Internal Networks
Web Applications
Login flows, input validation, access control, session handling
APIs & Microservices
Authentication, endpoints, rate limiting, data leakage
Cloud Infrastructure
Misconfigurations, open ports, identity & access policies
Internal Networks
Lateral movement, privilege escalation, known CVEs
Vulnerability Review or Pentest: Choose an Agreed Scope
A vulnerability review uses automated scanning to identify potential issues. A scoped pentest adds agreed manual testing and validation. The methods, depth and deliverables are defined for each engagement so you know what is being assessed and what remains outside the work.
Agree the assets and scenarios to assess before starting. Prioritize findings by evidence and business impact. Use the report to plan remediation and any follow-up testing.
Tell us which systems and objectives you want to assess. We confirm scope, deliverables and a realistic schedule before providing a proposal. View a sample pentest report.
A vulnerability scan is not a full penetration test. Written authorization, systems, methods, limits, testing windows, deliverables and any re-test are agreed before starting. Pricing and timing depend on the scope.
Vulnerability Review
- Scope agreed before scanning
- Automated vulnerability scan
- Summary of scan findings and limitations
Scoped Pentest
- Authorized applications or infrastructure
- Automated checks and manual validation
- Technical report and findings discussion
Extended Assessment
- Broader scope agreed after review
- Additional manual scenarios as agreed
- Prioritized remediation recommendations
Pentesting FAQs
Is a vulnerability scan the same as a penetration test?
No. A scan lists potential issues automatically. A penetration test adds manual validation within an agreed scope to confirm which weaknesses are exploitable and what impact they have.
Will testing affect our production systems?
Testing windows, limits and contacts are agreed in writing before starting. Techniques that could affect availability are excluded or scheduled with your team, and testing can be paused at any time.
What do you need from us before starting?
Written authorisation, the list of systems in scope, any test accounts required, a technical contact and the testing window. For grey or white box tests, the agreed documentation or access.
How long does a pentest take and how much does it cost?
It depends on the number and complexity of the systems and the depth agreed. We confirm scope, deliverables and a realistic schedule before sending a proposal.
Do you re-test after we fix the findings?
Yes, when re-testing is included in the agreed scope. It verifies that corrections work and documents the result.
Need help defining your testing scope?
Tell us which systems you want to assess and any deadline you are working to.