Penetration Testing
Most organisations are not breached through a zero-day. They are breached through a forgotten admin panel, a password reused from an old leak, or a firewall rule nobody has reviewed since the last office move.
A penetration test finds those things first, while you still control what happens next. We test your infrastructure, networks and systems the way an attacker would: by hand, looking for the chain rather than the checklist. You get a report your engineers can act on and your board can read.
Most engagements begin for one of four reasons
Someone has asked you for a test
A client, an auditor, an insurer or your board wants evidence, and it has to survive scrutiny.
You have never had one
You do not know what is exposed, and you would rather find out from us than from a ransom note.
Something significant changed
A cloud migration, an acquisition, a new office, a major release. Your attack surface moved and nobody has looked at it since.
Your last test was not a test
You paid for a report and received a scanner export with hundreds of informational findings and no indication which two mattered.
Scope is agreed with you before anything begins
Infrastructure
Risk surveys and penetration testing at infrastructure level: internet-facing hosts, exposed services, remote access, and the systems that have quietly accumulated since the last audit.
Internal networks and topology
What an attacker reaches after a single foothold. Lateral movement, privilege escalation, and whether your segmentation holds when it is tested rather than diagrammed.
Critical operating systems
Security evaluation of the systems your business cannot operate without, including hardening, patch state and privilege design.
Web servers and databases
Examination of information security in databases reachable through web servers, including access paths that bypass the application entirely.
Wireless networks
Rogue and look-alike access points, guest-to-corporate separation, authentication weaknesses, and what can be captured from outside the building.
Products and regulated systems
Resilience testing of your own products against the requirements of the regulation that applies to them.
We test manually, using methodologies chosen for the engagement
That selection matters more than it sounds. Testing to one fixed checklist produces one fixed result. A scanner will tell you that a service is running a version with a published vulnerability. It will not notice that an information leak on one host yields a username, that the username appears in an old password dump, that the password still works on a jump box, and that the jump box is holding an administrator session.
That chain is how a breach actually happens, and finding it is the work you are paying for.
Confirmed before we start
Which methodologies and techniques apply depends on what we are testing and why. We set the approach during scoping and confirm it with you in writing before any work begins.
Scope
Targets, test windows, exclusions and escalation routes, agreed and signed before anything starts.
Reconnaissance
Mapping what you actually expose, which is routinely more than the asset register says.
Exploitation
Controlled and evidenced, stopped at the point where the risk is proven.
Reporting
Findings ranked by real-world risk, with evidence and reproduction steps.
Retest
Verification once you have remediated, on terms agreed for the engagement.
What you receive
- An executive summary written for people who do not work in security. Plain English, and short enough to be read.
- Technical findings ranked by real-world risk, each with evidence, reproduction steps and the affected assets.
- Severity that accounts for your business context, not a generic score alone. A critical finding on an isolated test system is not a critical business risk.
- A prioritised remediation plan: what to fix now, what to schedule, and what you can reasonably accept and document.
- A walkthrough with your engineers, so findings are understood rather than filed.
- Retesting after remediation, on terms agreed for the engagement.
Timing and cost
We do not publish packages or price lists, because we have yet to meet two engagements that looked alike. Scope drives everything: how many hosts and environments, how much sits in the cloud, whether testing has to run outside business hours, and how much of the estate is genuinely in scope rather than nominally in scope.
So the first step is a short call. We will ask what prompted this, what you need to prove and to whom, and what you already suspect is weak.
What you get before committing
A written scope and a fixed price for that scope before any work begins, along with an honest answer if we think you are about to pay for the wrong test.
Common questions
Will testing take our systems down?
Do you need credentials, or do you start blind?
How often should we test?
Can you test our production environment?
What if you do not find anything critical?
Is a penetration test enough for ISO 27001 or SOC 2?
Certifications held across our team
Tell us what prompted this
We will tell you what is worth testing first, and scope it properly before you commit to anything.
Contact Cyberange