Penetration testing
A penetration test shows what an attacker can actually do, not just what a scanner flags. We test under written authorization, confirm each finding by exploiting it safely, and write up the fix. Because we also do physical testing, we can test the route an attacker would really take: through the door, onto the network.
Who it is for
- Organizations that need an annual test for PCI DSS, ISO 27001, SOC 2 or a customer.
- Teams launching a new application or API.
- Organizations that want to know how far an attacker gets from inside the building.
What we assess
- External: internet-facing hosts and services, discovery through to controlled exploitation.
- Internal and Active Directory: starting from a standard user device and account, toward agreed objectives.
- Web applications and APIs: authentication, authorization, input handling and business logic, following the OWASP Web Security Testing Guide.
- Cloud: see cloud security audit.
- Physical entry combined with network access, where authorized. See how a physical test works.
What you receive
- Every confirmed finding with evidence, severity and the fix.
- Attack paths, showing how findings chain together.
- An executive summary and a re-test of fixed findings.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically one to two weeks of testing per scope, agreed in the rules of engagement.
Common questions
What is the difference between a vulnerability scan and a penetration test?
A scan lists possible weaknesses automatically. A penetration test has a person confirm which ones are exploitable, chain them together, and show the real impact, without the false positives a scan produces.
Could testing take our systems down?
We agree targets, testing windows and emergency contacts in writing before we start, and we do not run denial-of-service tests. Anything risky is discussed with you first.
How often should we test?
At least once a year and after significant changes. PCI DSS requires exactly that for in-scope systems, and most customers asking for a test expect it annually.
Is the re-test included?
Yes. Once you have fixed findings, we re-test them and confirm in writing which are closed.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
Penetration testing
We reply within one business day.
Nothing you send is shared outside Calibre.