Penetration Testing & Ethical Hacking
We test whether vulnerabilities in your systems and applications can actually be exploited.
What we test
We test externally, on systems reachable from the internet, and internally, from within the corporate network. We can also test web applications.
Black-box, grey-box or white-box
In a black-box test we start without prior knowledge, like an outside attacker. In a grey-box test we get limited access, such as a standard user account. In a white-box test we receive technical information such as documentation or configurations.
Agreements beforehand
Before testing starts, we agree in writing what will be tested, which techniques are allowed and when testing takes place (rules of engagement).
Methodology
We follow NIST SP 800-115 and, for web applications, the OWASP Web Security Testing Guide. Attack paths are described with MITRE ATT&CK, and vulnerability severity is scored with CVSS.
Report and retest
You receive a management summary and the technical findings with evidence, a risk rating and recommendations. We go through the results together. After remediation, a retest can follow.