Pentest
Web, API, mobile apps, infrastructure, cloud. Manual work following OWASP and PTES, not a scanner export.
For business
Find the holes before the people looking for them do, and show the auditor your security is not on paper only.
Audit
Code, architecture, configuration. We say where the risk is real and where you can save the money.
Compliance
ISO 27001, SOC 2, GDPR, NIS2 and DORA. From gap analysis to policies and certification readiness. vCISO if you have no CISO of your own.
What you get
- A report with evidence, risk levels and a remediation plan that both a developer and a director understand
- A retest after the fixes with confirmation
- A one-page summary for management and the auditor
- A results walkthrough with your team online
Common questions
Where do we start if we have never done a pentest?
With a short conversation about systems and risks, after which we propose the scope and format. The first pentest is usually done on the main application in grey box mode.
Is a vulnerability scanner enough?
A scanner is useful as regular hygiene, but it does not see logic errors and does not chain findings into a real attack scenario. That is exactly what a pentest does.
How often should we repeat it?
Once a year or after significant changes to the system. For ISO 27001 and SOC 2 the frequency is fixed in the policies.
Confidentiality as a protocol, not a promise
This is how we handle your material from the first email to the destruction of artifacts.
Encrypted from the start
Material lives on an encrypted drive and only the engineer doing the work has access. Reports are delivered encrypted, the password goes through a separate channel.
Permission before the first scan
No testing without the system owner's written consent. Scope, testing windows and a stop word are agreed in advance.
Critical findings reported immediately
A dangerous finding is handed over the day we see it, not held for the final report.
Destruction on schedule
After the project the artifacts are destroyed and you get a certificate. A public case study only with separate written consent.
Check it yourself
Two free checks that show what anyone can see about you in a minute. No sign-up, results are not stored.
Check your website protection
What your site hands to every visitor: HTTPS redirect, security headers, third-party scripts and trackers, exposed software versions.
We make two ordinary requests to the home page, like a browser. Nothing is scanned or stored.
Check your email protection
Without SPF and DMARC anyone can send mail in your domain's name. The check reads only public DNS records and stores nothing.
We read only the public DNS records of the domain. Nothing is stored or scanned.
Write to us
The message goes straight to our Telegram. Nothing stays on the server.
Telegram
