Detect & Respond · Penetration Testing
Penetration Testing
A penetration test answers a specific question: can someone with realistic effort break into this system, and what could they do once inside? We test to answer that question, not to produce the longest possible finding list.
Delivered from our base in Utrecht, available to organisations across the Netherlands.
The problem
Automated vulnerability scans are useful but limited: they find what's already known and pattern-matchable. They don't chain findings together, don't understand your business logic, and don't tell you what an attacker could actually achieve once inside. That gap between 'we ran a scan' and 'we know our real exposure' is what penetration testing closes.
Business impact
A real attacker doesn't stop at the first vulnerability. They chain a minor finding into a foothold, the foothold into lateral movement, and lateral movement into the data or system that actually matters. Understanding that chain before an attacker does is the entire point of testing.
Testing scope is agreed upfront, and results come with clear reproduction steps and remediation guidance, not just a severity score.
Web application testing
Manual testing against the OWASP Top 10 and beyond, not just an automated scan with a report generated on top.
API testing
Authorization, authentication and business-logic testing for the APIs your applications and partners depend on.
Cloud & infrastructure testing
Configuration and access-control testing across cloud environments and on-premises infrastructure.
Network testing
External and internal network penetration testing to identify realistic attack paths.
Mobile & wireless testing
iOS, Android and wireless network security assessment.
Attack path assessment
Chaining findings together the way an attacker would, rather than reporting each vulnerability in isolation.
Retesting & validation
Confirming that remediated findings are actually fixed, not just marked closed.
How this engagement runs
Assess
Understand the current state, real risk, and what's actually driving the need for this work.
Architect
Design the controls and approach that fit your environment, not a generic template.
Implement
Deploy and integrate the work: configuration, code, or process, whichever the engagement calls for.
Validate
Test that it actually holds up, rather than assuming it does because it's been deployed.
Improve
Feed findings back in as your environment and the threat landscape change.
Who this is for
- Organisations required to demonstrate penetration testing for compliance (ISO 27001, SOC 2, customer contracts)
- Companies about to launch a new application or platform who want independent validation first
- Businesses that have invested in security controls and want to confirm they actually hold up
- Organisations running an annual or recurring testing programme as part of ongoing risk management
What you get
- A signed scope and written authorisation document before testing begins
- A findings report with reproduction steps, severity and business impact
- An executive summary suitable for non-technical stakeholders
- Remediation guidance specific to your environment
- A retest confirming fixes actually close the finding
Frequently asked questions
How much does a penetration test cost?
It depends on scope: the size of the application or network, the testing depth required, and whether retesting is included. We scope and quote based on your actual environment rather than a fixed package, since a five-page web app and a complex API platform aren't the same engagement.
How long does a penetration test take?
Most engagements run one to three weeks of active testing depending on scope, followed by reporting. We agree a timeline upfront as part of scoping, before any testing starts.
What's the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment identifies and catalogues potential weaknesses, largely through automated scanning. A penetration test goes further, manually exploiting findings to confirm real impact and chaining them together the way an attacker actually would. Both have a place; they answer different questions.
Do you provide a letter of authorisation for compliance purposes?
Yes. Every engagement includes a signed scope and authorisation document, which is often exactly what's needed for a compliance requirement or to satisfy a customer's security questionnaire.
What happens after vulnerabilities are identified?
You get a report with clear reproduction steps, severity, and remediation guidance, and if you want help fixing what's found rather than just a list of problems, that's exactly what our engineering services are for.
Related services
Related insights
Talk to a security engineer about penetration testing.
All testing requires written authorisation from the system owner before it begins. If you need a test scoped and authorised properly, that's the first conversation.