Penetration Testing

Penetration Testing

Penetration testing, or pentest, is an assessment used to evaluate and improve the security of systems (hardware and software), networks, and applications. It is a systematic and repeatable process for identifying and assessing cyber vulnerability, thereby gaining the insights required to develop and prioritise suitable risk mitigation activities.

• Assurance that your technology is secure, and/or tailored remediation plans addressing any found vulnerabilities 
• Measurable security improvements tailored to your organisation’s needs, and the added benefit of metrics that can be reported to stakeholders such as the Board of Directors 
• Support and strategic alignment to improve 

API Penetration Test

The penetration test of web services checks security in services that are based on protocols such as SOAP/XML and REST. The process involves a complete analysis of the web service to find any weaknesses, technical flaws or vulnerabilities in logic or code.  

Web application penetration test

Our penetration test of web application checks security in a web application such as CMSs, ERP systems, control interfaces and web infrastructure. 

SCADA/ICS (Industrial Control Systems) and OT (Operating Technology) penetration test

Physical security penetration test

The penetration test of SCADA/ICS will provide customer verification of the security in and around systems that control automated processes.

Our physical penetration test will check the completeness and effectiveness of physical security controls implemented by a company, and possibly associated third parties, to protect their facilities and assets.

Mobile applications

A security review of mobile application checks security in applications that runs on top of mobile OS’s such as Android, iOS and Windows phone. The process involves dynamic analysis and testing of the application to find any weaknesses, technical flaws or vulnerabilities in logic or code. Static analysis may also be conducted depending on programming language, platform and scope/time.

Network penetration test​

Can be performed from an external perspective (from the internet) or assuming breach from a corporate laptop or server. The test consists of scanning your infrastructure for vulnerabilities and analyzing and linking these to potential form exploitation chains enabling us to penetrate your network. Assuming breach, we focus on maintaining and extending our persistence on the network, targeting directory services such as (Azure) Active Directory. 

Red team test

Strictly speaking not a penetration test. The red team test will simulate a cyber-attack that will test the company’s ability to resist, detect and possibly handle realistic and relevant attacks. The process involves the preparation and implementation of scenarios. The result of such a test will give business an indication of how exposed their IT systems are and their ability to detect and react to attacks. A red team test can be performed as a TLPT (Threat Lead Penetration Test) to fulfill regulations such as DORA or based on the TIBER framework.