Adversary simulation, not vulnerability scanning.
We test the way an adversary would actually attack — chaining vulnerabilities, abusing trust relationships, pivoting through identity. You get exploit narratives, business-impact framing, and remediation guidance ranked by risk. Scanners can't do this.
- Engagement
- Project
- Typical duration
- 2–4 weeks
- Team
- OSCP / CRTO / OSCE
- Deliverable
- Narrative report
What we test
We scope precisely so the work targets your actual risk — not a generic checklist.
External penetration testing
Internet-exposed perimeter: web apps, APIs, VPN, mail, DNS, and the long tail. We test what an unauthenticated adversary can reach.
Internal penetration testing
What happens after initial access. Active Directory abuse, lateral movement, privilege escalation, data exfiltration paths.
Cloud penetration testing
AWS, Azure, GCP. Identity misuse, role-chain abuse, public storage, metadata service exposure, lambda privesc.
Network & wireless testing
Segmentation validation, wireless attack surface, VLAN hopping, IoT exposure in production environments.
Social engineering
Targeted phishing and pretext campaigns scoped to your environment — designed to validate awareness training and IR detection.
Exploit narrative & chaining
Every finding is presented as a narrative: how the adversary got in, what they could reach, why it matters to the business.
Risk-ranked remediation
Findings prioritized by exploitability × business impact — not CVSS score. Engineering-ready fix guidance, not just descriptions.
Retest included
30-day retest of remediated findings included in every engagement. You shouldn't have to pay twice to confirm the fix.
From scoping to retest
- 01Week 0
Scoping call
We agree on targets, methodology, testing windows, and rules of engagement. Fixed-price SOW with named lead testers.
- 02Week 1
Reconnaissance & discovery
Passive recon, asset discovery, attack-surface mapping. Most clients learn something here about what's actually exposed.
- 03Weeks 1–3
Active testing
Manual exploitation work, paired with automated tooling where useful. We chain findings — a 'low' that enables a 'critical' isn't a low.
- 04Week 3
Report draft & debrief
Findings written up with executive summary, technical detail, and exploit narratives. 90-minute debrief with engineering and leadership.
- 05Day 30
Retest
30-day window to remediate. We retest fixed findings and update the report. You can share the final report with auditors and customers.
What you walk away with
- Executive summary your board can read in 5 minutes
- Technical findings with full exploit narratives
- Risk-ranked remediation roadmap (exploitability × business impact)
- Engineering-ready fix guidance per finding
- Retest report confirming remediations
- Audit-ready evidence for SOC 2, ISO 27001, PCI, HITRUST, CMMC
- Customer-shareable attestation letter
- Confidence that you've been tested by humans, not just scanners
What makes our engagement different
We chain findings
Scanners report individual vulnerabilities. We chain them into attack paths and tell you which combinations actually matter. A 'low' that enables a 'critical' isn't a low.
Narrative reports
Every finding is a story: how the adversary got in, what they touched, why it matters to your business. Auditors and executives can both read it.
Retest included
30-day retest is in scope, not a change order. You shouldn't have to pay twice to confirm the fix.
Senior testers only
Every test is led by an OSCP / CRTO / OSCE-certified senior tester. No bait-and-switch where a senior scopes and juniors execute.
Common questions
How is this different from a vulnerability scan?
A vulnerability scan finds known issues from a signature database. A pen test demonstrates whether and how those (and unknown) issues can be exploited and chained against your specific environment. Both have a place — but they're not substitutes.
Will this break production?
Standard engagements use non-destructive techniques and avoid production-impact tests. If you want destructive testing (DoS validation, ransomware-style simulation), we'll scope it explicitly and run it in a maintenance window.
Can you support our SOC 2 / ISO / PCI audit?
Yes. Reports are written to satisfy auditor evidence requirements. We've worked with most of the major audit firms and can speak directly with your auditor if needed.
Do you provide a clean letter for customer trust calls?
Yes. Every engagement closes with a customer-shareable attestation letter summarizing scope, methodology, and high-level posture — without disclosing exploitable details.
What's the difference between this and a red team?
A pen test enumerates exploitable findings within a defined scope. A red team is goal-based (e.g., 'reach the customer database') and tests detection and response. Most clients start with pen testing and graduate to red team annually.
You may also want
Scope a pen test this quarter.
We typically book 4–6 weeks out. Start the scoping conversation now to land tests inside your audit cycle.