Cyber Security
Penetration Testing
We run controlled attack tests against your systems, identify vulnerabilities and report the findings with remediation advice.
Benefits of Penetration Testing
Security Analysis
We examine the systems in scope and classify vulnerabilities by risk level.
Preventive Steps
We give remediation advice for each finding. After a fix we run a verification test.
Planned Test
We plan, run and report the test according to the scope form. We agree on the test time with you.
Customer Trust
Regular tests and fixed vulnerabilities give your customers and partners evidence of your security processes.
Corporate Reputation
Finding vulnerabilities before attackers do reduces the risk of data breaches and reputational damage.
What is the difference between a penetration test and a vulnerability scan?
A vulnerability scan checks systems with automated tools and lists known vulnerabilities. A penetration test goes one step further: an expert uses the vulnerabilities found in a controlled way and shows how far an attacker can get.
A scan is suitable for checking many systems at short intervals. A penetration test shows the real impact of vulnerabilities and removes false positives. The two methods complement each other. Our article on this topic: What is Vulnerability Management and What Does It Encompass?.
What types of penetration tests are there?
The test type depends on how much information the test team has at the start:
- Black box: The team knows only the target addresses. The test shows the view of an external attacker.
- Gray box: The team gets limited information and a user account. The test measures what an authorized user or a compromised account can do.
- White box: The team has access to architecture documents and configuration information. The test gives the most detailed review.
Tests are also grouped by target: external network, internal network, web application, mobile application and wireless network tests. We define the test type and scope together with you, based on the information in the scope form.
What does a penetration test report contain?
At the end of the test we report the findings and remediation advice. The report contains:
- Scope: The systems tested and the test time.
- Findings: The vulnerabilities found in the systems in scope.
- Risk level: The classification of each vulnerability by risk level.
- Remediation advice: The recommended fix for each finding.
In the verification test we retry each fixed vulnerability with the same method. We recommend that you turn the findings into a remediation plan by priority. Fix high-risk findings first.
How do you prepare for a penetration test?
- Define the scope in writing: the IP addresses, domain names and applications to test.
- Inform your business units of the test time. Select a suitable time window for critical systems.
- Take a current backup of the systems in scope before the test.
- Give the test source addresses to your firewall and SIEM teams. This way, test traffic is not mistaken for a real attack.
- Name a contact person who is reachable during the test.
Plan penetration testing as part of a regular security program. Our articles for more information: Penetration Testing: Strengthen Your Cybersecurity and Why You Should Treat Penetration Testing Like a Cyber Drill. For continuous monitoring of security events, see SIEM – SOC Management.
Frequently asked questions
What Is a Penetration Test and Why Is It Important?
A penetration test is a controlled attack simulation that finds vulnerabilities in information systems. The goal is to find and fix weaknesses before malicious actors do.
How Does the Penetration Test Process Work?
Pentest form: this form helps to set the scope, the details and the size of the work. Planning and reconnaissance: the scope and targets of the test are set. Scanning: the target systems are scanned for potential vulnerabilities. Gaining access: the testers try to access the system through the vulnerabilities they found. Expanding the scope: deeper tests run on the system they accessed. Reporting: a report lists the vulnerabilities and recommendations on how to close them.
What Areas Does a Penetration Test Cover?
Penetration tests can cover network security, web applications, mobile applications, wireless networks, social engineering, physical security and more. The scope of the test depends on the needs of the organization.
Who Should Do Penetration Tests?
Experienced security specialists should run a penetration test with a written scope. The test is planned so that it does not affect system operation.
How Often Should You Do Penetration Tests?
We recommend penetration tests at regular intervals (for example, once or twice a year). A penetration test is also necessary after important system updates or changes.
Related services
SIEM – SOC Management
We collect your system logs in a SIEM platform, monitor security events with our SOC team and pass verified incidents on to you.
Firewall Management
We install your firewall, write its rule set and run it day to day. We work with FortiGate, Palo Alto Networks and MikroTik devices.
Cyber Threat Intelligence (CTI) Management
We monitor threat intelligence sources, extract the indicators (IOCs) that matter to you, feed them into your security systems and send you prioritized alerts and reports.
Let's discuss your project
Tell us what you need and we will match you with the right team. For urgent issues, call our support line.