Penetration testing

We act only with written consent from the system owner and under a contract with a clear scope and dates, and the wording of that consent is worth agreeing with your lawyer. We never test systems belonging to anyone else, even when asked by someone claiming to have the right, unless a document from the actual owner exists.

We work carefully and avoid destructive techniques, but any testing carries some risk. That is why we prefer a copy of the environment. If production must be included, we require an agreed time window and a fresh backup.

A scanner compares the system with a database of known patterns and is good at spotting outdated libraries. Logic flaws, such as reaching other people's data or getting round a discount limit, are invisible to it. That needs a human, and a thorough test combines both.

We do not issue security certificates and do not promise any. You receive a report describing the scope, method, dates and results, together with confirmation of the retest. You can show that document to an auditor, a client or use it in your NIS2 risk analysis.

At least once a year and after any major change, for example a new payment module or a move to another platform. For organisations covered by NIS2, regular testing is a natural part of managing risk.