Penetration Testing

What Is Penetration Testing?

Penetration testing (pentesting) is a controlled simulation of cyberattacks performed by certified security experts to identify vulnerabilities in IT systems, applications and network infrastructure before real attackers exploit them.

Attribute	Value
Methodology	OWASP WSTG, PTES, NIST SP 800-115
Team certifications	OSCP, CEH, GPEN
Lead time	3-21 business days
Price	from €3,000
Deliverable	Report with PoC, CVSS and recommendations

nFlo performs penetration tests for companies in Poland: external, internal, web application, mobile and cloud infrastructure pentests — the full scope of services is described below.

We cover the definition, phases and testing models in more depth in the article what penetration tests are and how they work.

What a Breach Without Testing Looks Like — An Illustrative Scenario

Imagine an online store whose admin panel has long contained an undetected SQL injection vulnerability. An attacker finds it with an automated scanner and exfiltrates the customer database: personal data, addresses, order history. The company only learns about the incident when the data appears for sale on the dark web. What follows: notifying the supervisory authority within 72 hours, exposure to fines under Article 83 GDPR, informing customers and loss of trust. A vulnerability like this is a typical finding of a web application penetration test.

Without regular penetration testing:

• Critical vulnerabilities remain unknown for years
• Hackers find vulnerabilities faster than you (average 15 days from CVE publication)
• You don’t meet PCI DSS, ISO 27001, and NIS2 requirements
• Breach costs: average $4.45M (IBM, 2023)

Controlled Attack with Concrete Evidence

We don’t just run automated scans. Our pentesters (OSCP, CEH) think like attackers - they chain vulnerabilities, test unusual vectors, look for business logic flaws. You get proof-of-concept showing exactly how you can be attacked.

What you get:

• Tests following OWASP WSTG, PTES, or NIST SP 800-115 methodology
• Vulnerability identification with CVSS 3.1 risk rating
• Proof-of-Concept for each vulnerability found
• Prioritization by business risk (not just technical)
• Detailed remediation steps for IT team
• Executive summary report for management
• Retest after implementing fixes: included in web application test packages, optional for other tests

Who is it for?

This service is for you if:

• You need to meet compliance requirements (PCI DSS requires pentests every 12 months)
• You’re launching a new web application or API to production
• You’re moving to cloud and want to verify configuration security
• You’re subject to NIS2 and need regular security assessment
• You want independent verification of DevSecOps team work

Penetration Testing Services — Scope

Each area below is a separate service with its own methodology, scope and price. This page brings them together — details are on the individual service pages.

External Testing (External Pentest)

Simulated attack from the internet on publicly accessible resources:

• Web applications and APIs
• VPN and RDP servers
• Email infrastructure (Office 365, Google Workspace)
• Public cloud services (S3 buckets, Azure Storage)
• DNS configuration and SSL/TLS certificates

Typical time: 3-7 business days | Price from: €6,000 | External IT infrastructure penetration testing

Internal Testing (Internal Pentest)

Simulated attack from employee or network intruder position:

• Lateral movement in Active Directory
• Privilege escalation
• Access to critical systems and data
• Network segmentation and firewall effectiveness
• Vulnerabilities in internal applications

Typical time: 5-10 business days | Price from: €8,000 | Internal IT infrastructure penetration testing

Web Application Testing (OWASP Top 10)

Detailed security analysis of web applications:

• Injection (SQL, NoSQL, LDAP, OS command)
• Broken Authentication & Session Management
• XSS (Cross-Site Scripting)
• CSRF (Cross-Site Request Forgery)
• Security Misconfiguration
• Business Logic Flaws

Typical time: 5-21 business days (depending on package) | Price from: €3,000 | Comprehensive web application penetration testing

Mobile Application Testing

Security analysis of iOS and Android applications:

• Static analysis (SAST) and dynamic analysis (DAST)
• Backend API security
• Sensitive data storage
• Network communication and certificate pinning
• Reverse engineering and tamper protection

Typical time: 7-12 business days | Price from: €9,500 | Mobile application security testing

Desktop Applications, APIs and Wi-Fi Networks

• Desktop application security testing — reverse engineering and binary analysis of software installed on workstations
• Web services and API security testing — REST, SOAP and GraphQL interfaces tested against the OWASP API Security Top 10
• Professional Wi-Fi penetration testing — wireless networks and segmentation

Specialized Penetration Testing

Beyond standard tests, we run engagements tailored to specific environments and technologies:

• OT/ICS systems penetration testing — industrial environments (SCADA, PLC)
• Medical systems penetration testing — medical devices and HIS/PACS systems
• Firmware (embedded) penetration testing — IoT and embedded devices
• AI and LLM application penetration testing — chatbots, assistants and AI agents: data leakage, prompt injection, tool abuse
• Web3 Penetration Testing — dApps, APIs, wallet integration and key management, RPC nodes, and Solidity/EVM smart contract audits

Red Team, TLPT and Social Engineering Tests

When the goal is not a list of vulnerabilities within a scope, but checking whether the organisation detects and stops a real attack:

• Red Team — a multi-week adversary simulation using APT techniques, including social engineering
• DORA TLPT testing — external tester in TLPT, test preparation and a pre-TLPT red team
• Social engineering tests — phishing, vishing and other scenarios testing employee resilience

How We Work: The Penetration Testing Engagement

Every project follows the same five steps — whether we test an application, a network or an industrial environment:

1. Scope and quote. We agree what is tested: systems and IP addresses, applications, user roles, access to source code and documentation, and the testing model (black, grey or white box). On that basis we prepare a free quote.
2. Rules of engagement (RoE). Before testing we agree the scope, limitations, dates and a technical contact on your side. For production applications we recommend a pre-prod environment or a maintenance window — tests are controlled and non-destructive.
3. Testing. Reconnaissance, automated and manual testing, controlled attempts to exploit vulnerabilities and chain them into attack paths. If we find a critical vulnerability (CVSS ≥ 9.0) during a web application test, we do not wait for the final report — we notify the technical contact within the time agreed in the contract.
4. Report and debrief. An executive summary for management and a technical part with PoC, CVSS 3.1 ratings, priorities and remediation steps. We walk the team through the results — at a presentation meeting for web application tests and in workshops for the IT team for internal tests.
5. Retest. After fixes are deployed, we check that they work. In web application test packages the retest is included (within 14 days of you reporting readiness); for other tests it is optional. For the fixes themselves, see remediation support.

Penetration Testing Pricing — What the Quote Includes and What Drives the Price

Starting prices for each type of test, in one place:

Test type	Typical time	Price from
External pentest	3-7 business days	€6,000
Internal pentest	5-10 business days	€8,000
Web application test	5-21 business days (depending on package)	€3,000
Mobile application test	7-12 business days	€9,500

What the price includes. Every test ends with a report containing Proof-of-Concept for the vulnerabilities found, CVSS 3.1 ratings, priorities based on business risk, remediation steps for the IT team and an executive summary for management. Rules of engagement (RoE) are agreed before testing starts. A retest after fixes is included in web application test packages; for other tests it is optional.

What drives the price. The quote reflects the time needed to test the agreed scope. The Penetration Testing Execution Standard (PTES) sets out a scoping questionnaire before pricing: for a network test it asks, among other things, how many external and internal IP addresses are in scope; for a web application test — how many applications, login systems and static and dynamic pages there are, whether source code and documentation will be available, and whether role-based testing is wanted. NIST SP 800-115 advises that the test plan name the systems and networks that may be examined — for example by the number of systems and their IP address ranges. The price also depends on the testing model (white box with source code analysis is the most expensive one) and on whether the quote covers a retest; PTES advises that the contract state how soon after the final report any retest must take place.

For a broader look at budgets, costs and return on investment, read our penetration testing cost analysis. We prepare a detailed quote free of charge once the scope is defined — contact us.

Penetration Test vs Vulnerability Scan vs Security Audit

These three services answer different questions and do not replace one another:

	Vulnerability scan	Penetration test	Security audit
Question	Which known vulnerabilities are visible in the systems?	Can an attacker exploit them, and how far can they get?	Do safeguards, processes and policies meet the requirements of standards?
Method	Automated tool	Manual pentester work supported by tools	Assessment of infrastructure, processes and documentation
Result	List of vulnerabilities, often with false positives	Confirmed vulnerabilities with PoC and attack paths	Remediation roadmap and compliance assessment (ISO 27001, NIS2, GDPR)

A scan works as a regular check within IT vulnerability management, and a security audit when you need a compliance assessment. We compare scanning and pentesting in detail, with reference to NIST SP 800-115, in the article penetration test vs vulnerability scan — the differences.

Choosing a penetration testing company

Start with the team: ask about hands-on certifications (e.g. OSCP, OSWE, GPEN) and who exactly will perform the test. Ask for a sample, anonymised report — it shows whether the provider delivers PoC and concrete remediation steps or just scanner output. Check the methodology (OWASP WSTG, PTES, NIST SP 800-115), how rules of engagement are agreed and the retest terms. We have collected the criteria and questions to ask before signing a contract in the article how to choose a penetration testing service provider.

Standards and Compliance

Penetration testing is increasingly a regulatory requirement rather than a best-practice option:

• PCI DSS (req. 11.3, 11.4) — mandatory pentests at least every 12 months and after significant changes
• NIS2 (art. 21) — regular testing of the effectiveness of cybersecurity measures
• DORA — threat-led penetration testing (TLPT) for the financial sector
• ISO 27001 (A.8.8) — technical vulnerability management with periodic verification
• OSSTMM — open methodology for measuring operational security

Pentesting works best as part of a broader process — we combine it with IT vulnerability management, source code vulnerability review, security audits, and compliance projects under KSC and NIS2.

Related Glossary Terms

Learn more about key concepts related to this service:

• CVSS
• Vulnerability Assessment
• SAST
• DAST
• API
• VPN
• CVE
• Vulnerability