Authorized attack simulation against only the systems you name.
Written rules of engagement, a confidential report and a debrief. Production impact agreed in advance.
A pentest is a test you scheduled.
Penetration testing is an authorized attempt to demonstrate how an attacker could abuse a named system. It sits under Testing. It is not an unannounced attack and it is not a substitute for an incident-response retainer.
We recommend a pentest when a client, insurer or internal policy asks for one, or when an assessment has already shown that a deeper, human-led test is warranted. If a scoped assessment or a scan will answer the question, we will say so.
The same authorization rules apply for clients internationally. Adjacent networks and third-party clouds are out of scope unless named.
Web applications
Authenticated and unauthenticated testing of applications you operate, within the accounts and roles you provide.
External networks
Internet-facing hosts and services you list. Neighbouring ranges are out unless they are written into the scope.
Mobile applications
When you supply a build and test accounts. Store-listing or customer-device testing is not included unless agreed.
AI systems
Prompt injection, agent misuse and data leakage against named models and tools. See AI assurance.
Named targets. A stop contact.
- Written authorization from someone who can approve testing of the named assets.
- Named targets only. IP ranges, hostnames, applications and models in the statement of work.
- No destructive production tests by default. Separate written approval for high-impact checks.
- Confidential report. Findings are yours. We do not retain them for marketing or training examples.
What you receive
- Confirmed findings and severity
- Reproduction notes sufficient for your team
- A debrief call
- Retest of agreed items, scoped after fixes
Request a written proposal.
Describe the system, vendor or AI deployment under consideration. We respond with the proposed scope, timeline and fee.