Application and infrastructure pentest

What we test

Scope is agreed with you before a single packet goes out, and ranges from a single application to the entire estate.

• Web applications — authentication, authorization, business logic, injection, SSRF, deserialization, file upload and the dependency chain.
• REST and GraphQL APIs — object and function level access control, rate limiting, excessive data exposure, introspection.
• Android and iOS applications — local storage, certificate pinning, backend communication, binary reverse engineering.
• External infrastructure — exposed surface, forgotten services, leaked credentials, weak TLS and DNS configuration.
• Internal networks and Active Directory — escalation paths, delegations, ACLs, NTLM relay, Kerberos and lateral movement.

How we run it

Automated tooling is a starting point, not a deliverable. Scanners find what is already catalogued; the flaw that takes your business down usually sits in logic nobody else tested that way.

The work is predominantly manual: we map the application as a legitimate user, understand the rules it tries to enforce, then look for where those rules can be bypassed. Every confirmed hypothesis becomes an artifact with request, response and reproduction steps.

We chain findings whenever possible. A medium severity flaw leading into another medium can compose a critical path — and it is that path, not the sum of individual scores, that drives remediation priority.

Methodology alignment

Our execution follows public, auditable references, which makes life easier for anyone who has to answer to a customer, an audit or a compliance framework.

• OWASP Testing Guide and OWASP ASVS for web applications.
• OWASP MASVS for mobile applications.
• PTES and NIST SP 800-115 for overall engagement conduct.
• CVSS v3.1 for scoring, always paired with the context of your environment.
• MITRE ATT&CK to describe techniques used during post-exploitation.

What you receive

• Executive report — what was tested, what was found and what it means for the business, in language the board understands.
• Technical report — each finding with description, evidence, reproducible proof of concept, CVSS and a specific recommendation.
• Prioritized remediation runbook — the order to fix in, weighing effort against real risk rather than score alone.
• Walkthrough session with your team to answer questions and align on remediation.
• Retest of the fixed items, closing the loop with evidence that the flaw is actually gone.

When a pentest makes sense

• Before a new application reaches production, or after a large refactor.
• When a customer, a contract or an audit requires independent security assessment.
• Periodically, to keep up with a surface that grows alongside the product.
• After an incident, to find out whether the exploited path is still open elsewhere.

Frequently asked

How long does a pentest take?

A targeted test usually takes one to three weeks, depending on surface size and agreed depth. The timeline is set together with the scope, before we start.

Do you test in production?

Yes, when authorized and within the rules of engagement. We define windows, agree on communication channels and avoid techniques that risk downtime, unless resilience testing is an explicit part of the objective.

How is this different from a vulnerability scan?

A scan compares your environment against a database of known vulnerabilities and returns a list. A pentest confirms what is actually exploitable in your context, chains flaws together and demonstrates impact. A scan produces alerts; a pentest produces evidence.

Other services

• Red team and adversary simulation
• Phishing simulation and social engineering
• Offensive security training
• Custom corporate CTFs