Penetration testing

A pentest is only worth as much as you can actually fix based on the report. That is why our report is not a list of tools and scans, but a document from which management understands the risk and the technical team knows exactly what to fix, how, and in what order. Every report we deliver contains:

• Executive summary: the overall risk level and the potential business impact, written in the language of decision makers, free of jargon.
• A list of all findings with CVSS scores: each vulnerability rated by severity and likelihood of exploitation, within the context of your environment.
• Proof of concept (PoC): screenshots and steps demonstrating that the vulnerability is genuinely exploitable, not theoretical.
• Reproduction steps: your team or an external partner can independently repeat and verify every finding.
• Specific remediation instructions: what to change, where, and with what priority, instead of generic advice such as "update your software".
• Strategic recommendations: recurring systemic causes (e.g. password management, segmentation, patching processes) and how to resolve them permanently.
• Retest and confirmation: once you apply the fixes, we verify the findings again and issue a certificate confirming that the testing was performed.

You can present the testing certificate to business partners, insurers or auditors as evidence that you take security verification seriously; increasingly, this is also a contractual or regulatory requirement.

Duration depends on the scope: the number of targets, the depth of the test and the type of access (black, grey or white box). For a typical small or medium business, the indicative ranges look like this:

Add 2 to 4 days for preparing the report and the retest after remediation. Timelines are always agreed in advance, including the time windows in which testing is permitted (e.g. outside business hours for production systems).

Pricing is not calculated per item but per day of expert work (man days), which is why no universal price list exists. The more targets and the deeper the test, the more days of work it takes. We broke down all the factors that push the price up or down in our article on how much penetration testing costs. The scoping assessment and the quote are free of charge and carry no obligation.

A vulnerability scanner is an automated tool: it quickly finds known flaws, but it cannot distinguish theoretical risk from genuinely exploitable risk, it generates false positives and it misses errors in business logic. A pentest is performed by a human: vulnerabilities are chained into an attack path, the real impact on your data and business is demonstrated, and the noise is removed from the report.

One does not replace the other. Scanning is hygiene that should run continuously, while a pentest is a deep, manual assessment carried out once or twice a year. If someone delivers a "pentest" that is merely a scanner export, you have paid for the wrong service. How to recognise that is covered in our comparison of pentest vs vulnerability scanning.

Is a pentest safe for production systems?

Yes. Before we start, the rules of engagement are agreed in writing: what may be tested, in which time windows, and which techniques are excluded (e.g. DoS attacks). Exploitation is carried out in a controlled manner, and we report critical findings immediately rather than waiting for the end of the test.

How often should a penetration test be performed?

At least once a year, and after every major change: a new application, migration to the cloud, network mergers or infrastructure changes. Regulations and standards such as ISO 27001, NIS2 and PCI DSS expect or directly require regular testing.

We have a firewall and antivirus. Do we still need a pentest?

Yes, because a pentest does not check whether you have protection in place, but whether it actually works. Most successful attacks do not break through the firewall; they exploit misconfiguration, weak passwords, application flaws or the human factor, and those are precisely the areas a pentest covers.

What happens if you find a critical vulnerability?

We notify you immediately, together with an interim measure that lets you reduce the risk the same day. The full description, proof and permanent fix follow in the report, and once you apply it, a retest confirms that the vulnerability is genuinely closed.

Is our data safe during the test?

Yes. We sign an NDA before starting, access only the agreed targets, and never take sensitive data out of your environment; a minimal sample is sufficient as proof. The report is delivered encrypted and is available only to the people you designate.