02 / Build / Penetration testing
PenetrationTesting Services
Find it before they do.
Testing that shows where your next best decision lives.
What you get
- Network, web application, cloud and wireless testing
- Findings explained in business terms, with proof
- Prioritized remediation guidance
- A retest to confirm fixes
How it works
We agree on scope and rules of engagement in writing, test, then walk your team through what we found and what to fix first.
What to expect
How a penetration test works
Aligned with PTES, OWASP and NIST SP 800-115, in five phases.
Scoping and rules of engagement
One to two weeks before start
Targets, exclusions, testing windows and emergency contacts agreed. Rules of engagement set the allowed techniques, prohibited actions and data handling, and you sign the authorization to test.
Reconnaissance and planning
Passive and active information gathering within the rules of engagement, an attack surface map, and priority targets.
Execution
Vulnerability discovery and validated exploitation as authorized, with privilege escalation, lateral movement and objective simulation where in scope. Critical findings go to your designated contact right away.
Analysis, reporting and debrief
Findings validated and rated Critical, High, Medium, Low or Informational. You get an executive summary and a technical report, then a debrief with technical and leadership stakeholders, with prioritized remediation guidance.
Retest
Recommended
After your remediation window we retest the fixed findings and update their status in the report.
Testing is performed under a signed statement of work and rules of engagement, in windows that suit your business.
Test types and what you receive
Test types
- External network and perimeter
- Internal network
- Web application and API
- Cloud: Azure, AWS and Microsoft 365
- Wireless and physical, when scoped
- Social engineering and phishing, only when explicitly authorized
What you receive
- Signed rules of engagement and authorization
- Penetration test report: executive summary and technical detail
- Findings tracker with remediation recommendations
- Retest report or status update, if performed
Bring us the complicated part.
Talk with a credentialed CISO and an accountable team. Email [email protected] or call (877) 77-vCISO.