Penetration Testing Services

Scoping

What are you looking to achieve by having a pen test performed? In our experience, most clients are aiming to achieve annual or semi-annual requirements along with several considerations: 

• New application or an update to an existing application
• Migration or incorporation of new devices into a network
• Incident or compromise
• Testing People, Processes and Procedures
• Testing Security Implementations andConfigurations

During the scoping discussion we will also cover:

• Number of devices and applications (targets)that will be tested
• The location of the targets
• Credentials to the targets to perform an unauthenticated and authenticated assessment
• Onsite and/or Remote testing

Rules of Engagement (ROE)

A mutual document between us and you that outlines what services will be performed, how they will be performed, what targets will be tested, and contact procedures. This document gives clear expectations on what to expect from the pen test.

Assessment

The assessment phase can last from one to several weeks depending on the type of assessment being performed by our team of specialists.

Reporting

We understand the significance of reporting and the impact results can have on the direction of security within an organization, so we aim to return a finished product to you within 5-10 business days following the completion of the assessment. Our reports target management and technical level stakeholders but can be customized to fit your needs:

• The number of vulnerabilities found and their severity (calculated using a custom risk matrix of impact and exploitability).
• The most likely attack path, forged by chaining together vulnerabilities we discovered during the assessment, a real-world attacker would take to access your most sensitive resources.
• Key Strengths and Weaknesses.
• Our Testing Details: Reconnaissance, Discovery, and Exploitation.
• Detailed proof of concepts to show how each vulnerability was discovered and exploited.