Your next enterprise deal SOC 2 audit ISO 27001 audit shouldn’t be blocked by a penetration test.

A penetration test report and a signed attestation letter. The report opens with an executive summary, lists every test class run and its outcome, then presents each vulnerability with its severity and its CVSS score, with detailed and prioritised steps to fix it, fitted to your stack. The attestation letter is the page you hand to a client or an auditor, certifying that a penetration test was carried out.

The scoping call is thirty minutes and can be booked for the same day. The quote follows within 24 hours. Testing starts within 48 hours of the signed authorisation and the prerequisites reaching us, runs 2 to 5 days depending on the scope, and the report and the attestation letter arrive within 24 hours of the last test.

The price depends on the scope to be tested, agreed together on the scoping call. A quote reaches you within 24 hours of that call. Renewals carry 20% off, because a certification and a security questionnaire both ask for a penetration test report less than a year old.

PCI DSS requires one outright, in requirement 11.4. ISO 27001 does not name a penetration test, but Annex A requires technical vulnerabilities to be identified, so some ISO auditors do ask for one. SOC 2 does not require one either, though a penetration test appears in it as a point of focus. In practice it is your customers’ security questionnaires that ask most often, and the report or the attestation letter is exactly what they require.

The URL of the environment to test, ideally a staging environment rather than production, and test accounts created for the pentest, one per application role. Nothing else on your side.

No. Testing is black box or grey box by default: you provision test accounts, the application URL, and nothing else. Source code access is only involved if you explicitly ask for a code audit, which is white-box testing.

Web applications, APIs, MCP servers, LLM agents, and any integration behind them: identity providers, cloud services, external platforms. On vulnerability classes, coverage is exhaustive: broken access control (IDOR, BOLA), privilege escalation, injection of every kind (SQL, XSS, RCE, LFI, RFI, LDAP, XXE), authentication and session management, SSRF, insecure deserialisation, data exposure, and for LLM agents prompt injection plus every class above reached through the agent or its MCP tools. Coverage follows the OWASP Top 10 for Web, the OWASP Top 10 for LLM and the OWASP Web Security Testing Guide.

Testing usually targets a staging, QA or development environment rather than production. No denial-of-service test is run unless you explicitly ask for one. The test window is agreed in advance, your pentester stays reachable throughout, and every request comes from a fixed IP address shared beforehand so you can identify the activity in your systems and their logs. A critical finding is reported the moment it is confirmed, not at the end.

An OSCP-certified pentester, who is also your point of contact from kickoff to your sign-off on the report. The same person writes the deliverables and stays with you through remediation.

Engagement data is encrypted at rest for the duration of the test and deleted on our side when it completes. Deliverables, credentials and other sensitive material are exchanged securely, and at the end of the pentest we remind you to delete the test accounts you provisioned.