Penetration Testing and Attack Surface
Penetration Testing
When a new digital channel launches or the annual test is due, you need a clear answer. Which vulnerabilities are actually exploitable? We manually test your applications and network, combining minor flaws to demonstrate real impact.
Penetration Testing
Automated scanners find known vulnerabilities. They cannot detect authorization errors that let one customer access another's account. Financial regulators also typically require an independent penetration test annually.
The need
When organizations need it
- Before launching a new mobile app or payment channel.
- When your annual independent test required by your financial regulator is due.
- After a significant change in your PCI DSS cardholder data environment.
- When a corporate customer requests an independent test report before signing.
Questions
What this work answers
- Can the internal network be accessed from internet-facing services?
- Do authorization controls work correctly for every role and API call?
- Does network segmentation effectively protect critical systems?
- Does our mobile app leave sensitive data on the device or in transit?
- What is the impact when minor vulnerabilities are combined?
Penetration Testing
What we do
-
Web Application Penetration Test
We test session, authorization, and input controls. We search for business logic errors in payment and approval steps.
-
API Penetration Test
We test whether users can access others' records in REST and GraphQL services. We also assess if the services can be abused.
-
Mobile Application Penetration Test
We test what your iOS and Android apps store on the device. We also review their server communication and backend APIs.
-
Internal Network Penetration Test
We test whether an attacker inside the network can access critical servers and domain administrator privileges.
-
External Network Penetration Test
We attempt to move from internet-facing services, such as a remote access gateway, into the internal network.
-
Wireless Network Penetration Test
We test authentication on wireless networks and the separation between guest and corporate networks.
-
Desktop Application Penetration Test
We test whether your desktop applications grant users excessive privileges. We also review stored data and the update mechanism.
-
Network Segmentation Validation
We verify what traffic actually passes between networks that should be separated. PCI DSS requires this test at least annually for the cardholder data environment.
-
VDI, Citrix and Kiosk Breakout Testing
We test whether a restricted session, such as a branch terminal or kiosk, can escape to the underlying system.
Scope
We define the systems and user roles in scope with you in advance. Testing can be performed from the internet, internal network, or as a logged-in user. Steps with disruption risk are only performed in scheduled windows.
How we work
We test with a separate user account for each role. This allows us to identify authorization errors that appear after login.
Deliverables
What you receive
A coverage matrix showing the method and privilege level used for each system. Findings that illustrate vulnerability chains step by step. The retest result after remediation.
NoteThe annual test is a starting point. After significant changes, we recommend retesting the affected area.
Related services
Request Test Scoping
Tell us your objective and critical systems. We will settle the right scope in the first meeting.
Schedule a Meeting