Penetration Testing

2 Million Records Leaked - A Real Story

A fashion e-commerce company lost 2 million customer records (personal data, addresses, order history). SQL injection in the admin panel - found by hackers in 3 hours. The company learned about the breach from the dark web after 2 weeks. Cost: GDPR fine €850,000 + reputation damage.

Without regular penetration testing:

• Critical vulnerabilities remain unknown for years
• Hackers find vulnerabilities faster than you (average 15 days from CVE publication)
• You don’t meet PCI DSS, ISO 27001, and NIS2 requirements
• Breach costs: average $4.45M (IBM, 2023)

Controlled Attack with Concrete Evidence

We don’t just run automated scans. Our pentesters (OSCP, CEH) think like attackers - they chain vulnerabilities, test unusual vectors, look for business logic flaws. You get proof-of-concept showing exactly how you can be attacked.

What you get:

• Tests following OWASP WSTG, PTES, or NIST SP 800-115 methodology
• Vulnerability identification with CVSS 3.1 risk rating
• Proof-of-Concept for each vulnerability found
• Prioritization by business risk (not just technical)
• Detailed remediation steps for IT team
• Executive summary report for management
• Optional: retest after implementing fixes

Who is it for?

This service is for you if:

• You need to meet compliance requirements (PCI DSS requires pentests every 12 months)
• You’re launching a new web application or API to production
• You’re moving to cloud and want to verify configuration security
• You’re subject to NIS2 and need regular security assessment
• You want independent verification of DevSecOps team work

Types of Penetration Tests

External Testing (External Pentest)

Simulated attack from the internet on publicly accessible resources:

• Web applications and APIs
• VPN and RDP servers
• Email infrastructure (Office 365, Google Workspace)
• Public cloud services (S3 buckets, Azure Storage)
• DNS configuration and SSL/TLS certificates

Typical time: 3-7 business days | Price from: €6,000

Internal Testing (Internal Pentest)

Simulated attack from employee or network intruder position:

• Lateral movement in Active Directory
• Privilege escalation
• Access to critical systems and data
• Network segmentation and firewall effectiveness
• Vulnerabilities in internal applications

Typical time: 5-10 business days | Price from: €8,500

Web Application Testing (OWASP Top 10)

Detailed security analysis of web applications:

• Injection (SQL, NoSQL, LDAP, OS command)
• Broken Authentication & Session Management
• XSS (Cross-Site Scripting)
• CSRF (Cross-Site Request Forgery)
• Security Misconfiguration
• Business Logic Flaws

Typical time: 5-15 days (depending on complexity) | Price from: €7,000

Mobile Application Testing

Security analysis of iOS and Android applications:

• Static analysis (SAST) and dynamic analysis (DAST)
• Backend API security
• Sensitive data storage
• Network communication and certificate pinning
• Reverse engineering and tamper protection

Typical time: 7-12 business days | Price from: €9,500

Specialized Penetration Testing

Beyond standard tests, we run engagements tailored to specific environments and technologies:

• Comprehensive web application penetration testing — deep OWASP Top 10 and business-logic testing
• External IT infrastructure penetration testing — attack surface visible from the internet
• Internal IT infrastructure penetration testing — Active Directory, lateral movement, privilege escalation
• Professional Wi-Fi penetration testing — wireless networks and segmentation
• OT/ICS systems penetration testing — industrial environments (SCADA, PLC)
• Medical systems penetration testing — medical devices and HIS/PACS systems
• Firmware (embedded) penetration testing — IoT and embedded devices

Standards and Compliance

Penetration testing is increasingly a regulatory requirement rather than a best-practice option:

• PCI DSS (req. 11.3, 11.4) — mandatory pentests at least every 12 months and after significant changes
• NIS2 (art. 21) — regular testing of the effectiveness of cybersecurity measures
• DORA — threat-led penetration testing (TLPT) for the financial sector
• ISO 27001 (A.8.8) — technical vulnerability management with periodic verification
• OSSTMM — open methodology for measuring operational security

Pentesting works best as part of a broader process — we combine it with IT vulnerability management, source code vulnerability review, security audits, and compliance projects under KSC and NIS2.

Related Glossary Terms

Learn more about key concepts related to this service:

• CVSS
• Vulnerability Assessment
• SAST
• DAST
• API
• VPN
• CVE
• SCA