Penetration Testing

2 Million Records Leaked - A Real Story

A fashion e-commerce company lost 2 million customer records (personal data, addresses, order history). SQL injection in the admin panel - found by hackers in 3 hours. The company learned about the breach from the dark web after 2 weeks. Cost: GDPR fine €850,000 + reputation damage.

Without regular penetration testing:

• Critical vulnerabilities remain unknown for years
• Hackers find vulnerabilities faster than you (average 15 days from CVE publication)
• You don’t meet PCI DSS, ISO 27001, and NIS2 requirements
• Breach costs: average $4.45M (IBM, 2023)

Controlled Attack with Concrete Evidence

We don’t just run automated scans. Our pentesters (OSCP, CEH) think like attackers - they chain vulnerabilities, test unusual vectors, look for business logic flaws. You get proof-of-concept showing exactly how you can be attacked.

What you get:

• Tests following OWASP WSTG, PTES, or NIST SP 800-115 methodology
• Vulnerability identification with CVSS 3.1 risk rating
• Proof-of-Concept for each vulnerability found
• Prioritization by business risk (not just technical)
• Detailed remediation steps for IT team
• Executive summary report for management
• Retest after implementing fixes: included in web application test packages, optional for other tests

Who is it for?

This service is for you if:

• You need to meet compliance requirements (PCI DSS requires pentests every 12 months)
• You’re launching a new web application or API to production
• You’re moving to cloud and want to verify configuration security
• You’re subject to NIS2 and need regular security assessment
• You want independent verification of DevSecOps team work

Types of Penetration Tests

External Testing (External Pentest)

Simulated attack from the internet on publicly accessible resources:

• Web applications and APIs
• VPN and RDP servers
• Email infrastructure (Office 365, Google Workspace)
• Public cloud services (S3 buckets, Azure Storage)
• DNS configuration and SSL/TLS certificates

Typical time: 3-7 business days | Price from: €6,000

Internal Testing (Internal Pentest)

Simulated attack from employee or network intruder position:

• Lateral movement in Active Directory
• Privilege escalation
• Access to critical systems and data
• Network segmentation and firewall effectiveness
• Vulnerabilities in internal applications

Typical time: 5-10 business days | Price from: €8,000

Web Application Testing (OWASP Top 10)

Detailed security analysis of web applications:

• Injection (SQL, NoSQL, LDAP, OS command)
• Broken Authentication & Session Management
• XSS (Cross-Site Scripting)
• CSRF (Cross-Site Request Forgery)
• Security Misconfiguration
• Business Logic Flaws

Typical time: 5-21 business days (depending on package) | Price from: €3,000

Mobile Application Testing

Security analysis of iOS and Android applications:

• Static analysis (SAST) and dynamic analysis (DAST)
• Backend API security
• Sensitive data storage
• Network communication and certificate pinning
• Reverse engineering and tamper protection

Typical time: 7-12 business days | Price from: €9,500

Specialized Penetration Testing

Beyond standard tests, we run engagements tailored to specific environments and technologies:

• Comprehensive web application penetration testing — deep OWASP Top 10 and business-logic testing
• External IT infrastructure penetration testing — attack surface visible from the internet
• Internal IT infrastructure penetration testing — Active Directory, lateral movement, privilege escalation
• Professional Wi-Fi penetration testing — wireless networks and segmentation
• OT/ICS systems penetration testing — industrial environments (SCADA, PLC)
• Medical systems penetration testing — medical devices and HIS/PACS systems
• Firmware (embedded) penetration testing — IoT and embedded devices

Penetration Testing Pricing — What the Quote Includes and What Drives the Price

Starting prices for each type of test, in one place:

Test type	Typical time	Price from
External pentest	3-7 business days	€6,000
Internal pentest	5-10 business days	€8,000
Web application test	5-21 business days (depending on package)	€3,000
Mobile application test	7-12 business days	€9,500

What the price includes. Every test ends with a report containing Proof-of-Concept for the vulnerabilities found, CVSS 3.1 ratings, priorities based on business risk, remediation steps for the IT team and an executive summary for management. Rules of engagement (RoE) are agreed before testing starts. A retest after fixes is included in web application test packages; for other tests it is optional.

What drives the price. The quote reflects the time needed to test the agreed scope. The Penetration Testing Execution Standard (PTES) sets out a scoping questionnaire before pricing: for a network test it asks, among other things, how many external and internal IP addresses are in scope; for a web application test — how many applications, login systems and static and dynamic pages there are, whether source code and documentation will be available, and whether role-based testing is wanted. NIST SP 800-115 advises that the test plan name the systems and networks that may be examined — for example by the number of systems and their IP address ranges. The price also depends on the testing model (white box with source code analysis is the most expensive one) and on whether the quote covers a retest; PTES advises that the contract state how soon after the final report any retest must take place.

For a broader look at budgets, costs and return on investment, read our penetration testing cost analysis. We prepare a detailed quote free of charge once the scope is defined — contact us.

Standards and Compliance

Penetration testing is increasingly a regulatory requirement rather than a best-practice option:

• PCI DSS (req. 11.3, 11.4) — mandatory pentests at least every 12 months and after significant changes
• NIS2 (art. 21) — regular testing of the effectiveness of cybersecurity measures
• DORA — threat-led penetration testing (TLPT) for the financial sector
• ISO 27001 (A.8.8) — technical vulnerability management with periodic verification
• OSSTMM — open methodology for measuring operational security

Pentesting works best as part of a broader process — we combine it with IT vulnerability management, source code vulnerability review, security audits, and compliance projects under KSC and NIS2.

Related Glossary Terms

Learn more about key concepts related to this service:

• CVSS
• Vulnerability Assessment
• SAST
• DAST
• API
• VPN
• CVE
• Vulnerability