Penetration testing, done the way an attacker would, with your signature first
We simulate real attack vectors against your applications, networks and people, inside a scope and rules you agree to in writing. Then we show you what worked, how, and what to fix first.
Overview
How we test
A penetration test is an authorised attack on your own systems. We look for weaknesses, try to exploit them, and stop where the rules of engagement say we stop. Scanners find candidates; people decide which ones actually open a door.
How much we know before we start changes the test. In a black box test we start with nothing but what is public, as an outside attacker would. In a grey box test we get the access of an ordinary user, or one with elevated privileges, which gives a more focused effort. In a white box test, also called clear box or logic-driven testing, we see everything: architecture, configuration and source code. It takes the longest and gives the most complete picture, and it works especially well for applications.
We can follow a recognised testing guideline such as OSSTMM, PTES, OWASP, ISSAF, PCI PTG, NIST SP 800-115 or CICA ITAC, or a custom one you define. The test can be shaped around what GDPR, HIPAA or HISO expect of you.
Who it is for
Organisations that want to know how their systems hold up before someone less polite finds out, and those whose clients, auditors, insurers or frameworks such as ISO/IEC 27001, PCI DSS or SOC 2 expect regular independent testing.
The work, from scoping to evidence.
What we do
Black box testing
No prior knowledge. We start from your public endpoints and work our way in, the way an outside attacker has to.
Grey box testing
We test with the knowledge and access of a basic or privileged user. Faster and more focused than black box, at the cost of the outsider's view.
White box testing
Full access to documentation, configuration and source code, for the most thorough look at both internal and external weaknesses.
Methodology of your choice
A recognised guideline such as OSSTMM, PTES, OWASP or NIST SP 800-115, or a custom one that matches your auditor's or client's expectations.
Specialised tests
Web applications and shops, APIs, mobile apps, networks, cloud, and people. They can be combined in one engagement.
Retest
Once you have fixed the findings, we test them again and record which ones are closed.
How the engagement runs
Kickoff and scoping
We agree the targets, the box type, the methodology and what is out of bounds. An NDA can be signed before the first meeting.
Proposal and authorisation
A business proposal, then written authorisation from someone entitled to give it, and rules of engagement: test windows, contacts, and what we do if we find something critical.
Testing
Reconnaissance, vulnerability discovery and controlled exploitation within the agreed rules. We tell you at once if we find something that cannot wait for the report.
Results handover
Recommendations, a business report with a risk assessment, and a technical report with proofs of concept, walked through with the people who will act on them.
Retest and closing
We verify your fixes and close the project with a feedback session. On request, a certificate of the engagement that anyone can verify on our site.
What you receive
- Agreed scope and rules of engagement
- Business report with risk assessment for management
- Technical report with proofs of concept and remediation advice
- Prioritised recommendations
- Retest results for the fixed findings
- Optional certificate of successful engagement, verifiable at /verify
Questions
Which box type should we choose?
Black box shows what an outsider can do. Grey box gets more done in the same time and covers what a logged-in user can reach. White box finds the most. If you are unsure, tell us what worries you and we will recommend one in the proposal.
Will testing disrupt our production systems?
We agree test windows, excluded systems and techniques in the rules of engagement, and we keep a contact on your side during the test. Some risk always remains with active testing, which is why we discuss it before we start, not after.
Is the certificate a compliance certification?
No. It is a record that the engagement took place and was completed, which anyone can check on our site. It does not certify you against any standard or law.
Do you retest after we fix the findings?
Yes. A retest of the reported findings is part of the engagement we propose, and the result is added to the record.
Related services
- Governance and riskSecurity risk assessmentInfrastructure, network and application risk assessment by Black Fox Security: probability versus severity, a risk register your owners use and treatment options.
- Managed securityVulnerability managementRecurring vulnerability reviews from Black Fox Security: scanning, triage, prioritisation by exploitability and exposure, fix tracking and trend reporting.
- Managed securitySecurity hardeningSecurity hardening by Black Fox Security: endpoint, server and network hardening, secure configuration baselines, monitoring setup and personal security.
- Governance and riskInformation security auditIndependent information security audits from Black Fox Security against ISO/IEC 27001, 27002, GDPR, PCI DSS, your own policies or a client's questionnaire.
Tell us what you want tested
Send us the targets and what keeps you up at night. We will come back with a scope, a box type and a proposal.