Penetration Testing

2 Million Records Leaked - A Real Story

A fashion e-commerce company lost 2 million customer records (personal data, addresses, order history). SQL injection in the admin panel - found by hackers in 3 hours. The company learned about the breach from the dark web after 2 weeks. Cost: GDPR fine €850,000 + reputation damage.

Without regular penetration testing:

• Critical vulnerabilities remain unknown for years
• Hackers find vulnerabilities faster than you (average 15 days from CVE publication)
• You don’t meet PCI DSS, ISO 27001, and NIS2 requirements
• Breach costs: average $4.45M (IBM, 2023)

Controlled Attack with Concrete Evidence

We don’t just run automated scans. Our pentesters (OSCP, CEH) think like attackers - they chain vulnerabilities, test unusual vectors, look for business logic flaws. You get proof-of-concept showing exactly how you can be attacked.

What you get:

• Tests following OWASP WSTG, PTES, or NIST SP 800-115 methodology
• Vulnerability identification with CVSS 3.1 risk rating
• Proof-of-Concept for each vulnerability found
• Prioritization by business risk (not just technical)
• Detailed remediation steps for IT team
• Executive summary report for management
• Optional: retest after implementing fixes

Who is it for?

This service is for you if:

• You need to meet compliance requirements (PCI DSS requires pentests every 12 months)
• You’re launching a new web application or API to production
• You’re moving to cloud and want to verify configuration security
• You’re subject to NIS2 and need regular security assessment
• You want independent verification of DevSecOps team work

Types of Penetration Tests

External Testing (External Pentest)

Simulated attack from the internet on publicly accessible resources:

• Web applications and APIs
• VPN and RDP servers
• Email infrastructure (Office 365, Google Workspace)
• Public cloud services (S3 buckets, Azure Storage)
• DNS configuration and SSL/TLS certificates

Typical time: 3-7 business days | Price from: €6,000

Internal Testing (Internal Pentest)

Simulated attack from employee or network intruder position:

• Lateral movement in Active Directory
• Privilege escalation
• Access to critical systems and data
• Network segmentation and firewall effectiveness
• Vulnerabilities in internal applications

Typical time: 5-10 business days | Price from: €8,500

Web Application Testing (OWASP Top 10)

Detailed security analysis of web applications:

• Injection (SQL, NoSQL, LDAP, OS command)
• Broken Authentication & Session Management
• XSS (Cross-Site Scripting)
• CSRF (Cross-Site Request Forgery)
• Security Misconfiguration
• Business Logic Flaws

Typical time: 5-15 days (depending on complexity) | Price from: €7,000

Mobile Application Testing

Security analysis of iOS and Android applications:

• Static analysis (SAST) and dynamic analysis (DAST)
• Backend API security
• Sensitive data storage
• Network communication and certificate pinning
• Reverse engineering and tamper protection

Typical time: 7-12 business days | Price from: €9,500