Pentesting
Manual penetration tests done by people, not scanners with a different logo. We find the vulnerability, prove the impact and tell you exactly how to close it.
- Web apps and APIs
- Mobile
- Cloud
- Internal infrastructure
- average from kick-off to report
- 2 wks
- average from kick-off to report
- of findings with a proof of concept
- 100%
- of findings with a proof of concept
- free retest included in every project
- Retest
- free retest included in every project
In detail
Manual testing by people, not a scanner with a logo.
An automated scanner finds the obvious. The flaws that end in a breach usually live in the logic: a user who sees another’s invoices by changing a number in the URL, a discount applied twice, or an API that trusts whatever the phone tells it.
Our pentesters follow OWASP WSTG, MASTG and PTES, but above all they think like an attacker with your business model in front of them. Every finding comes with a reproducible proof of concept, plain-language impact and a concrete fix for your stack.
When you are done fixing, we retest at no cost to confirm every vulnerability is closed. That retest is what your auditor or enterprise customer will ask for.
Real scenarios
Typical findings a scanner misses.
IDOR in the billing API
By changing a numeric ID, a customer could download anyone else’s invoices. 40,000 documents exposed with names, tax IDs and addresses.
Public bucket in production
A backup storage bucket was reachable without authentication. It held a full dump of the user database.
Non-expiring token in the app
The mobile app stored a never-expiring session token unencrypted. With access to the phone, anyone could operate the account indefinitely.
What you get
Everything you need to fix it and prove it.
- Executive summary with overall risk level
- Technical detail of each finding with proof of concept
- Fix recommendation specific to your technology
- Wrap-up call with your development team
- Retest and updated report
- Signed attestation letter
How we engage
Choose the scope you need.
Application
A specific web app, API or mobile app.
- 5 to 10 days
- Grey box with test users
- Ideal before a launch
- Most chosen
Platform
The full product: web, API, mobile and cloud.
- 2 to 4 weeks
- Cloud configuration review
- Valid for ISO 27001 and SOC 2
Continuous
Testing on every major release throughout the year.
- Annual pool of days
- Calendar priority
- Live findings dashboard
Offensive security
What is included
- 01
Web apps and APIs
OWASP Top 10, business logic, authentication, authorisation and API abuse.
- 02
Mobile
iOS and Android: storage, traffic, reverse engineering and runtime protections.
- 03
Cloud
AWS, Azure and GCP: identities, misconfigurations, Kubernetes and escalation paths.
- 04
Internal infrastructure
Active Directory, segmentation, exposed services and databases.
Pentesting
How we work
- 1
Scope
We agree assets, windows and environments in a 30-minute call.
- 2
Testing
Certified pentesters (OSCP, OSCE³, CRTO) attack by hand.
- 3
Report
Findings ranked by real risk with step-by-step remediation.
- 4
Retest
We verify every fix and issue a confirmation letter.
FAQ
Frequently asked questions
Do I need to stop production?
No. We can test in staging or in production within controlled windows.
Will auditors accept the report?
Yes. It is accepted by ISO 27001, SOC 2, PCI DSS and ENS auditors.
Do you need the source code?
Not necessarily. With grey-box access (test users and API documentation) we cover most risks. If you share the code, we can review critical areas in more depth.
Can you test in production?
Yes, carefully and within agreed windows. We still recommend a pre-production environment as close to production as possible.
How soon can you start?
Usually within 1 to 2 weeks of signing. For urgent pre-audit work we can start within days.
You may also need
Next step
Shall we talk about your case?
30 minutes with a partner, not a salesperson. No commitment.