Offensive security · Manual testing
Penetration testing and adversary simulation.
Pentesting in three forms: what your perimeter exposes, what your own web applications and APIs get wrong once someone is logged in, and what an attacker does with a foothold on the internal network. Manual testing, written rules of engagement, and a report your team can start fixing from the same day.
NDA as standard. Scope, test windows and source IPs are agreed in writing before testing starts.
Last updated: 3 November 2026
Engagement types
Three engagements, together or one at a time.
Each can be ordered on its own, with a separate proposal and its own prerequisites.
01
Perimeter, edge services, VPN gateways, client portals
External attack surface assessment
We map what you expose to the outside: published services, forgotten test subdomains, management interfaces facing the internet, outdated VPN gateways, client portals. Then we establish what an attacker reaches first and how far that carries them. The output is a host and service inventory, with everything that should not be reachable flagged.
What we need from you: A domain and IP list, and written confirmation that the assets are yours. Hosted assets also need the provider's authorisation.
02
Custom-developed applications
Web application and API penetration test
Authentication, authorisation, injection, business logic. Automated scanning comes first; the substance is manual testing where scanners cannot see: an object id another tenant's session accepts, a role the front end hides while the API still honours it, a transaction that runs twice under parallel requests.
What we need from you: Test accounts for at least two roles, a staging environment without live personal data, and a contact on the development side.
03
From an agreed foothold to a named objective
Assumed-breach exercise
We start from a workstation or account already in the attacker's hands and measure what happens next. We work the kill chain toward an objective named in advance: a file on a share, domain administrator, a query against a chosen database. Every step is logged with a timestamp and mapped to an ATT&CK technique, and we measure the defensive side throughout: what alerted, how fast, and what happened next.
What we need from you: A named objective, a starting access (an account or a machine), and a decision on whether the SOC is informed.
Rules of engagement
Agreed in writing before anything starts.
- Scope is defined host by host, domain by domain, application by application. Anything off the list stays untouched; exposed systems we come across are reported.
- Test windows are agreed to the time of day and fit around your business, month-end close included.
- Availability is protected: no denial-of-service or load testing, and no exploit known to take a service down.
- Changes to production data run only with prior written approval. On OT networks, active tooling runs only by agreement.
- Each side names a contact with a phone number. If a system behaves unusually mid-test, we stop at once and call.
- Source IPs are agreed up front so your SOC can separate test traffic. When detection is what is being measured, only the two contacts are informed.
The deliverable
A report your engineers can work from.
- 01Executive summaryOne page for leadership: the three most serious risks, their business impact, and the estimated remediation effort.
- 02Findings with reproduction stepsRequest, response, screenshot, the CWE it maps to, and the exact sequence a developer follows to reproduce it.
- 03Risk rankingCVSS and real business impact together: a 6.5 on the payment path ranks above a 9.8 on an isolated test host.
- 04Remediation steps for every findingNamed precisely: which config line, which code path, which firewall rule.
- 05Detection and response write-upWhat the defenders saw, what alerted, and the time between the first move and the first response.
- 06RetestRetest scope and deadline are part of the proposal.
The other half
We build the fix as well.
Remediation can continue in the same engagement: segmentation, access control, logging and hardening, built by the engineer who tested the environment.
Evidence collection and alert triage are covered on the security automation page, the technical side of NIS2 has its own page, and if the network runs alongside a production line, start with OT/IT security.
Frequently asked questions
What does a test cost?
It is scoped to the target list and engagement type: the domain and IP list for a perimeter, the number of roles and the staging setup for an application. After the intro call you get a written proposal against a fixed scope.
Automated scanning or manual testing?
Both. Automated scanning maps versions, open ports and known CVEs; the weight of the work is manual testing of the authorisation and business-logic layers, with false positives removed.
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment uses tools to list known weaknesses: outdated versions, open ports, published CVEs. It is fast and broad, but it does not show what is actually exploitable. A penetration test starts from that list and proves by hand which weaknesses can be exploited and how far an attacker gets with them. The report covers both, with false positives removed.
Do you work on site or remotely?
We are based in Budapest. External and application testing run remotely; walking the internal network happens on site where that matters.
Does testing put production at risk?
Testing is designed not to: no denial-of-service or load testing, production data changes only with written approval, active OT tooling only by agreement. If a system behaves unusually, we stop at once and call your contact.
Who sees the report?
Only you. An NDA is standard on every engagement, the report is delivered encrypted, raw test data retention is set in the contract, and the data is deleted when the engagement closes.
Do you work as a subcontractor for consultancies?
Yes. You keep the client relationship, the report goes out in your template, and we communicate with the end client only on your behalf.
When can it start, and how long does it run?
An external surface assessment is usually a few days, an application test one to two weeks, an assumed-breach exercise depends on scope. The start date is agreed on the first call.
Let's start
Bring the target list.
30 minutes, free. A domain list or an application name is enough: by the end of the call you have the engagement type, the timeline and the preparation list.