Penetration testing.
Network, web and API, mobile, wireless, cloud, physical, social engineering, and AI, up to a full red team. Book a one-time test, a recurring schedule, or continuous testing.
What we test
Each area is handled by a tester who specializes in it.
Network
External and internal testing for environments of any size.
- External perimeter
- Internal / assumed breach
- Active Directory
- Segmentation testing
Web applications and APIs
Credentialed testing against OWASP WSTG, ASVS, and the Top 10, including authentication, authorization, and business logic.
- OWASP Top 10
- ASVS Level 2/3
- Business-logic flaws
- API / GraphQL
Mobile applications
iOS and Android testing against OWASP MASTG, MASVS, and the Mobile Top 10, with full device instrumentation.
- Jailbreak / root bypass
- Runtime hooking (Frida)
- API / backend review
- Binary analysis
Wireless and RF
Wi-Fi, Bluetooth, Zigbee, LoRa, and other RF. WPA3, EAP, and rogue access points.
- 802.11 (Wi-Fi) / WPA3
- 802.15 (Zigbee, BLE)
- RFID / NFC cloning
- Rogue AP / Evil Twin
AI and LLM applications
Testing of LLMs, RAG pipelines, and AI agents against the OWASP Top 10 for LLM Applications: prompt injection, data leakage, supply chain, and excessive agency.
- OWASP Top 10 for LLMs
- Prompt injection & jailbreaks
- RAG / data leakage
- Agent privilege escalation
Physical security
Tailgating, badge cloning, lock bypass, drop boxes, and covert entry at your actual facilities.
- Facility covert entry
- Badge / RFID cloning
- Lock & safe bypass
- Drop-box implants
Social engineering
Phishing, vishing, smishing, and on-site pretexting. We test people the way real attackers do.
- Spear phishing
- Vishing / callback
- On-site pretext
- Deepfake scenarios
Cloud
AWS, Azure, GCP, and Kubernetes configuration, IAM, and workload testing against CIS and provider benchmarks.
- IAM / privilege escalation
- Config benchmarks
- K8s / container escape
- CI/CD supply chain
Red team
Multi-week, objective-based operations run quietly, so you see how your detection and response actually perform.
- Adversary emulation
- Purple-team handoff
- Mapped to MITRE ATT&CK
- 2 to 8 weeks
How a penetration test runs
Manual work by senior testers: careful scoping, thorough recon, controlled exploitation, and a report your team can use.
Scoping
We agree in writing on every target, every exclusion, the testing window, and emergency contacts. You know exactly what is in scope and what is not.
Recon
We map your external footprint before touching anything: DNS, certificates, leaked credentials, exposed cloud storage, and public staff information. Much of the real risk shows up here.
Exploitation
We exploit what we find, carefully, with every action logged and reversible, and document it against the testing standard you chose.
Post-exploitation
Once inside, we show how far an attacker could go: lateral movement, privilege escalation, and access to sensitive data. That is the real business impact.
Reporting
You get a technical write-up for your team, a prioritized fix list, and a one-page summary for leadership.
Test once, on a schedule, or continuously
Pick the option that fits how often your environment changes.
One-time test
A scoped engagement with a set start and end. We test, show the impact, and deliver the full report. A good fit for a compliance deadline, a customer or board requirement, an acquisition, or a first baseline.
Subscription
Testing on a set schedule at a predictable annual rate. You get priority scheduling, re-tests in every window, and a team that already knows your environment.
Continuous testing (PTaaS)
Ongoing testing through your client portal. We watch your external attack surface as it changes, test new releases on request, and report findings as we confirm them. Re-tests run on demand.
Not sure which fits? We will recommend one based on your environment and compliance calendar. Talk it through with us →
What you get
Every penetration test includes the following, delivered through your client portal.
Technical write-up
Every technique we tried, every path that worked, and why it matters.
Prioritized fix list
Every finding with its severity, exploitability, business impact, and how to fix it.
Executive summary
One page in plain language for leadership.
Attack recordings
Video of the key compromises, for your defenders to study.
Re-tests
Re-tests at 30 and 90 days to confirm your fixes worked.
Working sessions
Live debriefs with your engineers.
Tell us what you are working on.
A senior practitioner will reply within 24 hours with an honest assessment and suggested next steps.