Penetration Testing
A time-boxed offensive engagement against a defined scope — web, mobile, network, cloud, or full-chain.
- Outcome
- Adversary emulation, not scanner theater.
- Timeline
- 4 phases1–2 weeks · 3–6 weeks · 1–2 weeks · 1 week
- Mapped to
- MITREOWASP · NIST · PTES · OSSTMM 3
- Includes
- Readout + retestFixed criticals and highs re-verified.
Know before you book.
A time-boxed, authorised attack on your systems by people who think like adversaries, proving what could really be reached and how to stop it.
- A customer, investor or auditor is asking for a recent pen test report
- You're launching something significant or changed your architecture
- You want to know if your defences would notice a real attacker
- Your scope spans more than one surface: web, network, cloud or mobile
- You only need a broad list of weaknesses, not proven attack pathsVulnerability Assessment
- The system under test is an LLM feature or AI agentAI Penetration Testing
- Scope: applications, hosts, cloud accounts and what's off-limits
- Testing model: black, grey or white box
- A technical contact and an escalation path for critical findings
Still not sure? Take the 2-minute check
What you walk away with.
- Confirmed exploitation paths, not a theoretical CVE list
- Every TTP mapped to MITRE ATT&CK for your detection engineering
- An executive narrative your board will actually read
- Optional purple-team debrief with your defenders
What we cover
Agreed in writing before testing starts.
- Black-box, grey-box, or white-box models — your choice
- Web + API + mobile + thick-client + cloud + on-prem network
- Authenticated and unauthenticated test paths
- Chained exploitation across boundaries when scoped
- Optional coordinated notification with your SOC / MSSP
- Denial-of-service testing (excluded by default; opt-in only)
- Exfiltration of real customer PII (we use synthetic proxies)
- Destructive actions on production data
How we run it.
- 00
Pre-engagement
Signed Rules of Engagement, safe words, escalation contacts, blackout windows, evidence-handling procedure. Nothing starts until this is in place.
- 01
Reconnaissance
Passive OSINT + active discovery, AI-correlated. Every engagement starts here — and we spend real time on it.
- 02
Enumeration
Service, tech-stack, and trust-boundary mapping. The target model your team never drew.
- 03
Vulnerability Analysis
Candidate weaknesses identified and confirmed; AI triage clears the noise so operator hours go to what's actually exploitable.
- 04
Exploitation
Manual, iterative, chained. Custom TTPs where CVEs don't fit — the chains a scanner will never find.
- 05
Post-exploitation
Lateral movement, privilege escalation, blast-radius quantification. What could a real adversary do with what we took?
- 06
Report & retest
Two-audience report; optional live purple-team walkthrough so your defenders learn to detect every step. Retest within 90 days.
Technical detail.
The depth behind the engagement, for the engineer or CISO evaluating us.
- Black box: attacker's view, no inside knowledge
- Grey box: user accounts and some documentation
- White box: architecture and code access for depth
- PTES and NIST SP 800-115 phases
- TTPs mapped to MITRE ATT&CK
- Manual exploitation and chaining across boundaries
- Signed rules of engagement before testing
- Denial-of-service excluded unless opted in
- Critical findings reported within 24 hours
- Attack narrative and reproduction steps
- Detection guidance for your SOC
- Optional purple-team debrief and retest
What lands in your inbox.
- Penetration Test Report (executive + technical + appendices)
- MITRE ATT&CK matrix mapping of every TTP used
- Attack-narrative video walkthrough (optional)
- Purple-team session with detection-engineering guidance
- Retest of critical/high findings within 90 days
Defensible under audit.
- MITRE
- OWASP
- NIST
- PTES
- OSSTMM 3
From call to report.
- 01Scoping + ROE
1–2 weeks
- 02Testing window
3–6 weeks
- 03Reporting
1–2 weeks
- 04Purple-team + retest
1 week
Asked before every engagement.
How is this different from a vulnerability assessment?
A VA identifies weaknesses. A pen test proves they matter — by chaining them, escalating privileges, and demonstrating real business impact. A VA answers what's wrong; a pen test answers what could actually happen.
Do you use automated tools and AI?
For coverage and triage, yes — Burp, Nmap, custom fuzzers, and AI to correlate and prioritize. For exploitation and chaining, an operator drives every shot. Automation finds the door; a human decides whether to walk through it.
Can we run purple-team exercises alongside?
Yes. We can share our TTPs in real time with your SOC over a shared channel, or debrief at the end. Included in most engagements.
Book a scoping call.
Fixed scope, fixed price, delivered within 6–10 weeks of kickoff. Detailed engagement letter within 5 business days of our first call.