Penetration testing, scoped and explained.
A penetration test is an authorized, time-bound attempt to find and safely demonstrate weaknesses in your systems — the way an attacker might. You get evidence of what is exploitable, how much it matters, and how to fix it.
Scanners list possibilities. Testing shows what is real.
Automated scanners are useful but noisy, and they miss issues that depend on business logic or chained weaknesses. Customers, auditors and your own engineers need to know which issues are actually exploitable and what they would allow. A well-scoped test answers that within a defined window.
Who it is for
- SaaS providers before a major release
- Teams answering customer testing requirements
- Organizations preparing for SOC 2 or ISO/IEC 27001
- Businesses with internet-facing infrastructure
What a test engagement covers.
- Scoping of targets and objectives
- Written authorization and rules of engagement
- Manual testing supported by tooling within the agreed window
- Validation of each finding before reporting
- Business and technical read-out
- Retesting of fixed findings, if included
Choose the scope that answers your question.
Web application
Authentication, sessions, access control, input handling and business logic.
API security
Authorization between objects and users, data exposure, rate limits.
External network
Internet-facing hosts and services, from an outside perspective.
Internal network
What an attacker could reach after gaining an internal foothold.
Cloud-focused
Testing of cloud-hosted services and permissions, where agreed and permitted.
Six steps, from authorization to retest.
- 1
Scope & authorize
Define targets and obtain written authorization.
- 2
Rules of engagement
Agree methods, contacts and testing windows.
- 3
Test
Perform the agreed assessment within the window.
- 4
Validate & document
Confirm findings and record evidence.
- 5
Present
Walk through business and technical findings.
- 6
Retest
Verify fixes, if included in the agreement.
A report for two audiences.
Executive summary
Overall risk and key themes for leadership.
Technical findings
Each issue with a risk rating and affected assets.
Evidence & reproduction
Steps and screenshots, where appropriate.
Remediation guidance
Practical fixes, ordered by priority.
Retest results
Status of each finding after fixes, when included.
Important to know
Penetration testing is scoped and time-bound. It provides evidence about the systems tested during the testing window; it cannot identify every vulnerability or guarantee security. Testing only begins after written authorization from someone entitled to give it, including any third-party hosting providers where required.
Penetration Testing FAQ
What is included in a penetration test?
The targets, testing approach, time window, reporting and any retest are defined in the scope and rules of engagement before testing starts.
Will testing affect production?
We agree how to minimize risk — for example, testing windows, excluded actions or a staging environment. Some risk always exists with active testing, which is why it is planned with you.
Do you need source code?
Not for a standard test. Some engagements combine testing with code review when you choose to provide access.
Is a retest included?
Only if it is included in the agreement. It is usually worth including so you can show customers that issues were resolved.
Need a penetration test?
Share what you want tested and why. We will help define a scope that answers the right question.