Penetration Testing
We assess your network the way real threat actors do, first mapping what is reachable, then crafting specialised attacks against the specific services you expose. The result is a clear, interpreted report you can act on.
A two-stage, threat-actor-aligned methodology
The same approach attackers use: find the weak point, then build the attack for it.
Pre-assessment
We map the network topology and discover which services are reachable, alongside a set of general, non-specialised tests. This builds the picture of your attack surface.
Specialised assessment
Once the pre-assessment succeeds, we investigate specific services for known security gaps and disclosed zero-day vulnerabilities, with attacks crafted for your environment.
This methodology is, if not identical, very close to how threat actors operate today: they seek specific weak points, then proceed with a specialised cyberattack crafted for the organisation they have targeted. The same approach applies, with minor variations, to both External and Internal penetration testing.
How findings are reported
Three verdicts, each with a detailed interpretation of what it means and what it indicates.
No penetration achieved
The attack was blocked. Clearly, no further action is needed.
Penetration achieved: low risk
A successful penetration was achieved, but it is not an immediate risk, more of a recommendation.
Penetration achieved: immediate risk
A successful penetration was achieved and constitutes an immediate risk; the gap should be resolved as soon as possible.
Phishing testing
A second category of assessment, run in two procedures.
Known-signature attempt
We test whether the system rejects a phishing attempt using known signatures, reported domains/IPs and methodology. If no rejection is made, this case is a FAIL.
Zero-history obfuscated payload
We send a payload with zero history and apply partial obfuscation, so it cannot be detected by signatures alone, testing real detection capability.
Human factor: your call
We can test only the system, or also the human factor. Tell us which scope you'd like and we'll tailor the engagement.
Consulting included: no hour limit
Every engagement includes cybersecurity consulting on each finding, with no upper limit on hours. For any question on the mitigations you may need, we're there for you. Our goal is simple: after the assessment, attack vectors are eliminated, or reduced to the absolute minimum.
Promotion: choose your package
Bundle both and save, or take just what you need. All prices + VAT.
- External & Internal penetration testing
- Phishing testing (system, optionally human factor)
- Detailed, interpreted findings report
- Unlimited consulting hours
- External & Internal penetration testing
- Two-stage, threat-actor-aligned method
- Detailed, interpreted findings report
- Unlimited consulting hours
- Known-signature rejection test
- Zero-history obfuscated payload test
- Optional human-factor scope
- Unlimited consulting hours
Bought separately, pen testing (1,600 EUR) and phishing testing (1,000 EUR) come to 2,600 EUR, while the combined package is just 2,200 EUR, so you save 400 EUR.