Penetration testing (pentest)

A pentest is an ordered, authorised break-in attempt against your IT systems. It is like asking a security professional to try the locks on your office, to find out whether a real burglar would get in.

Who is it for?

  • Companies that want to know how well protected they really are.
  • Teams launching a new web application or system who want it checked before release.
  • NIS2-regulated organisations that must show their protective measures work.
  • Businesses whose customers or partners ask for an independent security test.

More than an automated scan

Automated tools only list known flaws. We think like attackers: we look not just for faults on individual servers, but for whether weaknesses can be chained into a real attack path, and how much damage that path could do.

Three testing approaches

Black-box

The outside burglar. We get no inside information and see only what a stranger would see.

Gray-box

The guest let in. We start from partial information or an ordinary user account, as with a compromised staff login.

White-box

The expert with the blueprints. We know how the system is built, so we can examine it as thoroughly as possible.

How we work

  1. Scoping and authorisation

    We agree in writing what, when and how we may test. We never start without authorisation.

  2. Reconnaissance

    We map the systems in scope, as an attacker would.

  3. Exploitation attempts

    We verify in a controlled way whether the weaknesses we found can really be exploited.

  4. Reporting

    Findings are ranked by severity, with remediation advice.

  5. Walk-through

    We go through the results in plain language with management and technical staff.

What you receive

  • An executive summary without jargon
  • A technical report with reproducible steps
  • Risk-based prioritisation
  • Specific remediation advice

Frequently asked questions

Can my systems go down during the test?

Risky steps are agreed in advance and we adapt to your operations. The boundaries of the test are set together.

Which approach should I choose?

Black-box shows an outside attacker’s view, gray-box a compromised account, and white-box gives the deepest review. We help you decide based on your goal.

Is this legal?

Yes, when the system owner authorises it in writing. We do not work without that.

References

  • RoadRecord